Fix ArgoCD ServerSideDiff permanent OutOfSync diffs

Add explicit CRD/API defaults to manifests that were causing ArgoCD's
SSA dry-run to produce results different from live state:

- HTTPRoutes: add group, kind, weight defaults to parentRefs/backendRefs
- Kyverno ClusterPolicies: add skipBackgroundRequests, allowExistingViolations
- Tetragon TracingPolicies: add return, maxData, resolve, returnCopy defaults
- Gateway certificateRefs: add group="" default
- Guacamole Gateway: add group="" to certificateRefs

Add ignoreDifferences for resources that legitimately differ:
- Cilium cert Secrets (auto-generated, data always differs)
- Istio ValidatingWebhookConfiguration failurePolicy (istiod mutates)
- Crowdsec LAPI Secrets (randomly generated)
- ServiceMonitor/PodMonitor relabeling action defaults
- StatefulSet volumeClaimTemplates apiVersion/kind defaults

Persist argocd-cm ignoreDifferences config in ArgoCD Helm values.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

apps/gitlab/manifests/envoy-routes.yaml

@@ -5,7 +5,9 @@ metadata:
   namespace: gitlab
 spec:
   parentRefs:
-    - name: edge
+    - group: gateway.networking.k8s.io
+      kind: Gateway
+      name: edge
       namespace: gateway
       sectionName: https
   hostnames:
@@ -16,8 +18,11 @@ spec:
             type: PathPrefix
             value: /
       backendRefs:
-        - name: gitlab-webservice-default
+        - group: ""
+          kind: Service
+          name: gitlab-webservice-default
           port: 8181
+          weight: 1
 
 ---
 apiVersion: gateway.networking.k8s.io/v1
@@ -27,7 +32,9 @@ metadata:
   namespace: gitlab
 spec:
   parentRefs:
-    - name: edge
+    - group: gateway.networking.k8s.io
+      kind: Gateway
+      name: edge
       namespace: gateway
       sectionName: https
   hostnames:
@@ -38,8 +45,11 @@ spec:
             type: PathPrefix
             value: /
       backendRefs:
-        - name: gitlab-registry
+        - group: ""
+          kind: Service
+          name: gitlab-registry
           port: 5000
+          weight: 1
 
 ---
 apiVersion: gateway.networking.k8s.io/v1
@@ -49,7 +59,9 @@ metadata:
   namespace: gitlab
 spec:
   parentRefs:
-    - name: edge
+    - group: gateway.networking.k8s.io
+      kind: Gateway
+      name: edge
       namespace: gateway
       sectionName: https
   hostnames:
@@ -60,8 +72,11 @@ spec:
             type: PathPrefix
             value: /
       backendRefs:
-        - name: gitlab-minio-svc
+        - group: ""
+          kind: Service
+          name: gitlab-minio-svc
           port: 9000
+          weight: 1
 
 ---
 apiVersion: gateway.networking.k8s.io/v1
@@ -71,7 +86,9 @@ metadata:
   namespace: gitlab
 spec:
   parentRefs:
-    - name: edge
+    - group: gateway.networking.k8s.io
+      kind: Gateway
+      name: edge
       namespace: gateway
       sectionName: https
   hostnames:
@@ -82,5 +99,8 @@ spec:
             type: PathPrefix
             value: /
       backendRefs:
-        - name: gitlab-kas
+        - group: ""
+          kind: Service
+          name: gitlab-kas
           port: 8154
+          weight: 1