Remove nessus app and fix envoy-gateway OCI chart bug

- Delete nessus Application CRD, manifests, and bootstrap script
- Vendor envoy-gateway Helm chart (v1.6.3) locally to work around
  ArgoCD v3.3.3 Docker Hub OCI resolution bug
- Re-enable auto-sync for envoy-gateway

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

charts/envoy-gateway/templates/envoy-proxy-topology-injector-webhook.yaml

@@ -0,0 +1,63 @@
+{{- if .Values.topologyInjector.enabled }}
+
+{{ $watchedNamespaces := list }}
+{{ $gatewayNamespaceMode := false}}
+{{- if .Values.config.envoyGateway.provider.kubernetes }}
+{{- $kube := .Values.config.envoyGateway.provider.kubernetes }}
+{{- $gatewayNamespaceMode = and ($kube.deploy) (eq $kube.deploy.type "GatewayNamespace") }}
+{{- if $kube.watch }}
+{{- if $kube.watch.namespaces }}
+{{- if gt (len $kube.watch.namespaces) 0 }}
+{{- $watchedNamespaces = $kube.watch.namespaces }}
+{{- end }}
+{{- end }}
+{{- end }}
+{{- end }}
+
+apiVersion: admissionregistration.k8s.io/v1
+kind: MutatingWebhookConfiguration
+metadata:
+  name: 'envoy-gateway-topology-injector.{{ .Release.Namespace }}'
+  annotations:
+    "helm.sh/hook": pre-install, pre-upgrade
+    "helm.sh/hook-weight": "-1"
+  {{- if .Values.topologyInjector.annotations }}
+    {{- toYaml .Values.topologyInjector.annotations | nindent 4 -}}
+  {{- end }}
+  labels:
+    app.kubernetes.io/component: topology-injector
+  {{- include "eg.labels" . | nindent 4 }}
+webhooks:
+  - name: topology.webhook.gateway.envoyproxy.io
+    admissionReviewVersions: ["v1"]
+    sideEffects: None
+    clientConfig:
+      service:
+        name: envoy-gateway
+        namespace: '{{ .Release.Namespace }}'
+        path: "/inject-pod-topology"
+        port: 9443
+    failurePolicy: Ignore
+    rules:
+      - operations: ["CREATE"]
+        apiGroups: [""]
+        apiVersions: ["v1"]
+        resources: ["pods/binding"]
+    {{- if not $gatewayNamespaceMode }}
+    namespaceSelector:
+      matchExpressions:
+        - key: kubernetes.io/metadata.name
+          operator: In
+          values:
+            - {{ .Release.Namespace }}
+    {{- else if gt (len $watchedNamespaces) 0 }}
+    namespaceSelector:
+      matchExpressions:
+        - key: kubernetes.io/metadata.name
+          operator: In
+          values:
+          {{- range $watchedNamespaces }}
+            - {{ . | quote }}
+          {{- end }}
+    {{- end }}
+{{- end }}