feat: allow opting out of unrestricted HTTPS egress

[jtatum]

The operator always permits TCP/443 to every destination, including private addresses, so custom egress rules cannot restrict HTTPS access. Add spec.security.networkPolicy.allowHTTPS, an optional boolean defaulting to true. Setting it to false removes the unrestricted HTTPS rule so users can allow specific destinations through additionalEgress while retaining operator-managed networking.

Omitted and explicit true values preserve existing behavior. DNS, custom rules, allowed CIDRs, and feature-specific egress remain unchanged. Includes regenerated CRDs for all installation paths, DeepCopy code, API reference, and a restrictive policy example.

Validation:

• make test passed, including controller envtest and go vet.
• GOTOOLCHAIN=go1.25.0 make lint passed using the CI toolchain.
• Helm and OLM CRD sync checks passed.
• Regression tests cover omitted/true/false, disabling both DNS and HTTPS, preserving egress isolation, and retaining other rules including destination-scoped TCP/443.
• A local kind smoke test passed on Kubernetes v1.34.0 (kind v0.30.0, linux/arm64), using an image built from de702a9 and the local Helm chart/CRDs. Omitting the field stored true; patching to false removed only unrestricted TCP/443; patching back to true restored the original policy without recreating it. Explicit false also survived initial creation. DNS, custom egress, ingress, and policy types were preserved.

The kind test used suspended instances to validate installation, API defaulting/storage, and reconciliation without starting the OpenClaw workload. Network traffic enforcement was not tested.