CP-33514: add server svc port protocol

[jake-cloudzero]

A PR to include #465 from a private contributor until we can fix CI to work for external contributors.

[evan-cz]

Do we have an associated jira issue yet? We need one... (SOC 2 isn't really designed with external contributors in mind)

[claude]

Documentation Issues

PR Description

The PR title references ticket "CP-33514: add server svc port protocol" but the description states this PR is meant to "include #465 from a private contributor." However, the actual change implemented sets appProtocol: https rather than modifying the port protocol field or making the port name configurable as described in PR #465.

Inconsistencies:

• The title mentions "server svc port protocol" which is ambiguous - it's actually setting the application protocol hint, not the port's transport protocol
• PR Explicitly set appProtocol for the webhook server service #465's description discusses renaming the port name from http to https and making it configurable via .Values.insightsController.service.portName, but this PR only adds appProtocol: https without making anything configurable
• The implementation doesn't match the solution described in PR Explicitly set appProtocol for the webhook server service #465 (which proposed a configurable port name via values)

Possibly Missing Documentation Updates

File: helm/README.md
Issue: The README extensively documents the webhook server and ValidatingWebhookConfiguration usage (lines 218-227) but makes no mention of the appProtocol field or its importance for service mesh compatibility (specifically Istio).
Required: Add documentation explaining:

• The appProtocol field ensures proper protocol detection by service meshes
• Why appProtocol: https is set despite the port name being http (backwards compatibility)
• That this resolves Istio BlackHoleCluster routing issues

File: helm/docs/troubleshooting-guide.md
Issue: The webhook troubleshooting section (lines 176-238) covers certificate issues and connectivity but doesn't mention service mesh-related protocol detection issues.
Required: Add troubleshooting guidance for Istio users experiencing webhook connectivity issues, mentioning the appProtocol field's role.

File: helm/docs/istio.md (referenced in helm/README.md:316)
Issue: The README references an Istio-specific guide, but the actual compatibility fix implemented here is not documented.
Required: Verify this file exists and documents the appProtocol: https setting and its purpose for Istio compatibility.

File: helm/values.yaml
Issue: No comment explaining the appProtocol field in the context of the service port configuration.
Required: Add inline comments explaining why this field is set and its importance for service mesh deployments.

Implementation Concerns

The implementation diverges from PR #465's proposed solution:

• PR Explicitly set appProtocol for the webhook server service #465 wanted a configurable port name via values
• This PR hardcodes appProtocol: https without adding any configurability
• The port name remains http (line 14 of webhook-service.yaml) which could still cause confusion

Consider whether the original approach from PR #465 (making the port name configurable and defaulting to https) would be more appropriate.