Fix ArgoCD ServerSideDiff permanent OutOfSync diffs

Add explicit CRD/API defaults to manifests that were causing ArgoCD's
SSA dry-run to produce results different from live state:

- HTTPRoutes: add group, kind, weight defaults to parentRefs/backendRefs
- Kyverno ClusterPolicies: add skipBackgroundRequests, allowExistingViolations
- Tetragon TracingPolicies: add return, maxData, resolve, returnCopy defaults
- Gateway certificateRefs: add group="" default
- Guacamole Gateway: add group="" to certificateRefs

Add ignoreDifferences for resources that legitimately differ:
- Cilium cert Secrets (auto-generated, data always differs)
- Istio ValidatingWebhookConfiguration failurePolicy (istiod mutates)
- Crowdsec LAPI Secrets (randomly generated)
- ServiceMonitor/PodMonitor relabeling action defaults
- StatefulSet volumeClaimTemplates apiVersion/kind defaults

Persist argocd-cm ignoreDifferences config in ArgoCD Helm values.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

apps/argocd/values.yaml

@@ -6,6 +6,36 @@ global:
 configs:
   cm:
     url: https://argocd.kube.huskypup.net
+    resource.customizations.ignoreDifferences.all: |
+      managedFieldsManagers:
+        - external-secrets
+        - istio-system
+      jqPathExpressions:
+        - .metadata.finalizers
+    resource.customizations.ignoreDifferences.external-secrets.io_ExternalSecret: |
+      jqPathExpressions:
+        - .metadata.annotations."force-sync"
+        - .metadata.annotations."reconcile.external-secrets.io/force-sync"
+        - .metadata.finalizers
+        - .spec.data[].remoteRef.conversionStrategy
+        - .spec.data[].remoteRef.decodingStrategy
+        - .spec.data[].remoteRef.metadataPolicy
+    resource.customizations.ignoreDifferences.gateway.networking.k8s.io_HTTPRoute: |
+      jqPathExpressions:
+        - .metadata.annotations
+        - .spec.parentRefs[].port
+    resource.customizations.ignoreDifferences.monitoring.coreos.com_ServiceMonitor: |
+      jqPathExpressions:
+        - .spec.endpoints[].relabelings[].action
+        - .spec.endpoints[].metricRelabelings[].action
+    resource.customizations.ignoreDifferences.monitoring.coreos.com_PodMonitor: |
+      jqPathExpressions:
+        - .spec.podMetricsEndpoints[].relabelings[].action
+        - .spec.podMetricsEndpoints[].metricRelabelings[].action
+    resource.customizations.ignoreDifferences.apps_StatefulSet: |
+      jqPathExpressions:
+        - .spec.volumeClaimTemplates[].apiVersion
+        - .spec.volumeClaimTemplates[].kind
     oidc.config: |
       name: Authentik
       issuer: https://auth.kube.huskypup.net/application/o/argocd/