feat(pruner): add NetworkPolicy for controller and webhook

[infernus01]

Changes

• Adds spec.networkPolicy to TektonPruner
• Reconciles three default NetworkPolicies: a scoped default-deny for all pruner (app.kubernetes.io/part-of: tekton-pruner), a controller allow policy (Prometheus metrics ingress on TCP/9090, unrestricted egress), and a webhook allow policy (admission callbacks on TCP/8443, Prometheus metrics on TCP/9090, unrestricted egress)
• Propagates spec.networkPolicy from TektonConfig → TektonPruner, so disabled: true on TektonConfig removes polcies
• Cleans up the pruner-network-policies CustomSet on TektonPruner CR deletion

Egress is unrestricted because the pruner controller needs API server access to list, watch, and delete PipelineRun/TaskRun resources across namespaces, and NetworkPolicy cannot select endpoints on the host network.

Submitter Checklist

These are the criteria that every PR should meet, please check them off as you
review them:

• Run make test lint before submitting a PR
• Includes tests (if functionality changed/added)
• Includes docs (if user facing)
• Commit messages follow commit message best practices

See the contribution guide for more details.

Release Notes

NONE

/kind feature

[tekton-robot]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
To complete the pull request process, please assign jkhelil after the PR has been reviewed.
You can assign the PR to them by writing /assign @jkhelil in a comment when ready.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 25.32%. Comparing base (3d8e72a) to head (834246f).
⚠️ Report is 1 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #3795      +/-   ##
==========================================
- Coverage   25.40%   25.32%   -0.08%     
==========================================
  Files         449      450       +1     
  Lines       23477    23555      +78     
==========================================
+ Hits         5964     5966       +2     
- Misses      16822    16897      +75     
- Partials      691      692       +1     

Flag	Coverage Δ
unit-tests	25.32% <ø> (-0.08%)	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[jkhelil]

@infernus01
Add validation to pkg/apis/operator/v1alpha1/tektonpruner_validation.go
Fix: add errs = errs.Also(tp.Spec.NetworkPolicy.validate("spec.networkPolicy")) to TektonPruner.Validate().

[jkhelil]

why this change ? can you rerun ./hack/update-codegen.sh/

[jkhelil]

@infernus01 Add Release note

[jkhelil]

/kind misc