fix: split the ext proc config to avoid k8s size limits

[zhaohuabing]

Description

This PR splits the ext proc/mcpproxy config into multiple secrets, so it can bypass the k8s size limits.

Related Issues/PRs (if applicable)

Fixes #1613

cc @nacx

[codecov-commenter]

Codecov Report

❌ Patch coverage is 81.57895% with 56 lines in your changes missing coverage. Please review.
✅ Project coverage is 84.23%. Comparing base (505bc4d) to head (fee5510).
⚠️ Report is 10 commits behind head on main.

Files with missing lines	Patch %	Lines
internal/controller/filter_config_bundle.go	72.72%	11 Missing and 7 partials ⚠️
internal/filterapi/watcher.go	70.68%	10 Missing and 7 partials ⚠️
internal/controller/gateway.go	47.05%	6 Missing and 3 partials ⚠️
internal/controller/gateway_mutator.go	95.45%	2 Missing and 2 partials ⚠️
internal/controller/secret_name.go	90.24%	2 Missing and 2 partials ⚠️
internal/filterapi/config_bundle.go	88.23%	2 Missing and 2 partials ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #1865      +/-   ##
==========================================
+ Coverage   83.71%   84.23%   +0.52%     
==========================================
  Files         126      131       +5     
  Lines       16657    17786    +1129     
==========================================
+ Hits        13944    14982    +1038     
- Misses       1811     1856      +45     
- Partials      902      948      +46     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[nacx]

Overall, it looks good.

So the summary of the PR is that:

• It will split the secret if it exceeds the max object k8s size, and split to a max of 8 chunks (for now).
• If there is no size overflow, empty chunks up to the 8 max ones will be created to avoid having to remount and cycle the pod.
• The extproc receives a new parameter, -configBundlePath, that if present will start the new watcher to watch for the new chunked config.

If this understanding is OK :) I have a few questions:

• Can we avoid creating the empty chunks? We could still add the volumes and secret projections to the pod, but mark those optional? Would that work to avoid having to create the empty secrets?
• The controller will pass the new arg -configBundlePath to the extproc if it finds the "index" secret. That secret is always created now, correct?
  • Could we provide a way to opt-in to this new feature, so that the controller does not create this secret (and extproc does not instantiate the new watchers, etc, etc)? This is quite a sensitive feature, and it would be great to have an option to explicitly opt-in.

Thanks for this PR!