Configure trusted proxies for the in-Pod authentication proxy

[coderabbitai]

Summary

Configure Quarkus trusted-proxy validation for the Cryostat authentication proxy deployment.

The Operator deploys Cryostat and the authentication proxy in the same Pod. The proxy forwards requests to http://localhost:8181. Configure the Cryostat core container to trust the Pod loopback addresses.

Required changes

• Add QUARKUS_HTTP_PROXY_TRUSTED_PROXIES=127.0.0.1,::1 to the core-container environment generated by internal/controller/common/resource_definitions/resource_definitions.go.
• Update resource-definition tests and expected environment definitions, including internal/test/resources.go.

Rationale

Cryostat enables forwarded-header processing in this deployment. Trusted-proxy validation must restrict forwarded headers to the in-Pod authentication proxy. Include both IPv4 and IPv6 loopback addresses because the upstream can connect through either address family.

Acceptance criteria

• Generated Cryostat core-container environment includes QUARKUS_HTTP_PROXY_TRUSTED_PROXIES=127.0.0.1,::1.
• Tests verify the generated environment variable.
• Existing proxy forwarding configuration remains enabled.

References

• Source PR: fix(discovery): validate plugin callback resolves to client address cryostat#1725
• Review discussion: fix(discovery): validate plugin callback resolves to client address cryostat#1725 (comment)
• Requested by: @andrewazores