[v3.24] Remove legacy waf-http-filter ext_proc sidecar (PMREQ-384)

[electricjesus]

Cherry-pick of #4925.

Description

The WAF data plane on Enterprise Gateway moved to the Coraza WASM filter baked into the envoy-proxy image (EV-6701). The old waf-http-filter ext_proc sidecar is no longer how WAF is enforced, but gateway_api.go still injects it into every Enterprise envoy-proxy deployment. With both running, the proxy pod gets stuck at 3/4 ready and serves no traffic. PMREQ-384 already signed off on deprecating the sidecar.

This PR removes the sidecar from the gateway-api render, and nothing else.

Removed:

• the waf-http-filter init container
• its two WAF-only volumes (the var-log-calico HostPath and the waf-http-filter emptyDir socket) and the socket mount on the envoy container
• the calicoImage field and its image resolution, which only fed that container
• the LOGGER_GATEWAY_NAME / LOGGER_GATEWAY_NAMESPACE env vars, which only that container used

Kept on purpose: the waf-http-filter-named ServiceAccount, the two ClusterRoles, and the per-namespace RoleBindings. The l7-log-collector sidecar runs in the same pod under that identity and still needs it for license checks and Gateway-API reads. Renaming those objects to something l7-appropriate is a separate follow-up.

The l7-log-collector render is untouched.

This is an Enterprise-only change to the gateway-api render. It pairs with a calico-private PR that deletes the sidecar binary itself (link below). Merge this one first: the combined calico binary keeps the now-unused waf-http-filter subcommand until this lands in a hashrelease, so removing the render first is safe and removing the binary first is not.

Companion calico-private PR (draft, merges after this): tigera/calico-private#12308

Test plan

• go test ./pkg/render/gatewayapi/ passes. The two specs that asserted the sidecar was deployed now assert only l7-log-collector is, and the owning-gateway env test was updated for the new init-container count.
• go build ./..., go vet ./pkg/render/gatewayapi/, and gofmt are all clean.

Cherry-pick re-verified on release-v1.43: clean pick, go build / go vet / gofmt / go test ./pkg/render/gatewayapi/ all pass.

Release Note

Remove the deprecated waf-http-filter sidecar from the Enterprise Gateway data plane. WAF is now enforced by the Coraza WASM filter on the envoy-proxy.