Deploy WAF containers when enabled in NGINXProxy

[ciarams87]

Proposed changes

Problem: In order to enable NAP WAF protection for NGF traffic, we need to install the nap module in the NGINX container, provide a mechanism to deploy the additional WAF v5 containers in the NGINX deployment, and then set the base app_protect_* directives in the NGINX conf

Solution:

1. Add the ability to build a NAP WAF image:

• Update the NGINX Plus Dockerfile to optionally install the app protect module when INCLUDE_NAP_WAF=true
• Extend the ENTRYPOINT script to create an additional required file
• Create an additional Make target to build the image

2. Extend the NGINXProxy resource to support WAF

• Add a toggle to enable waf in the NGINXProxy resource
• If enabled, deploy the additional waf containers
• Add support for user overrides of certain parameters of the waf containers (image, resources, additional volumes)
• If WAF is enabled, add the required base app_protect_* directives to the nginx conf (load module and enforcer address)

3. Extend the Helm chart to support these new configuration options

Notes:

• NAP v5 is supported in both OSS and Plus. This PR only adds Dockerfile support for Plus, but deploying an NGF compatible OSS image with the NAP module installed isn't blocked by this implementation
• Building the image and testing in the pipeline will be handled in a separate PR

Testing: Deployed in GKE (NAP WAF does not run on arm64 and we can't use emulated images locally, so deploying NAP requires an amd64 architecture). Created the NAP enabled image, used NGINXProxy to set WAF to true, used user provided images for the waf containers (I cached them to the GCP registry), and I mounted an additional volume to NGINX and waf-config-mgr for bundles (as we don't have the next part developed yet). Once deployed, I used kubectl cp to copy the bundle to the mounted volume. I used snippets to create the app protect directives at the server level, and checked that the firewall blocked the malicious appearing traffic.

Closes #3451
Closes #3453

Checklist

Before creating a PR, run through this checklist and mark each as complete.

• I have read the CONTRIBUTING doc
• I have added tests that prove my fix is effective or that my feature works
• I have checked that all unit tests pass after adding my changes
• [] I have updated necessary documentation
• I have rebased my branch onto main
• I will ensure my PR is targeting the main branch and pulling from my branch from my own fork

Release notes

If this PR introduces a change that affects users and needs to be mentioned in the release notes,
please add a brief note that summarizes the change.

NONE

[codecov]

Codecov Report

Attention: Patch coverage is 97.94989% with 9 lines in your changes missing coverage. Please review.

Project coverage is 86.94%. Comparing base (0bbb602) to head (2472887).
Report is 1 commits behind head on feat/nap-waf.

Files with missing lines	Patch %	Lines
internal/controller/provisioner/objects.go	98.39%	5 Missing and 2 partials ⚠️
internal/controller/state/graph/nginxproxy.go	0.00%	2 Missing ⚠️

Additional details and impacted files

@@               Coverage Diff                @@
##           feat/nap-waf    #3481      +/-   ##
================================================
+ Coverage         86.78%   86.94%   +0.16%     
================================================
  Files               127      127              
  Lines             15079    15308     +229     
  Branches             62       62              
================================================
+ Hits              13086    13310     +224     
- Misses             1841     1845       +4     
- Partials            152      153       +1     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[sjberman]

(FYI I think if you want to close multiple issues in one PR, you have to specify Closes: xxx on multiple lines)

[salonichf5]

lgtm 🚀