Add Envoy Gateway cookie-based session persistence for Guacamole OIDC

Fixes OIDC nonce validation failures with 2 replicas by using a
BackendTrafficPolicy with cookie-based consistent hashing instead of
Service-level ClientIP affinity (which doesn't work behind Envoy proxy).

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

apps/guacamole/manifests/deployment-complete.yaml

@@ -227,10 +227,6 @@ metadata:
     component: client
 spec:
   type: ClusterIP
-  sessionAffinity: ClientIP
-  sessionAffinityConfig:
-    clientIP:
-      timeoutSeconds: 3600
   ports:
     - port: 8080
       targetPort: http