feat(kube): restrict CronJob egress to kube-apiserver only

[h0lybyte]

Summary

• Adds NetworkPolicies to restrict CronJob pods to only kube-apiserver + DNS egress
• crossplane-system: locks down s3-healthcheck CronJob
• kilobase: locks down backup-restore-test and backup-watchdog CronJobs
• All three CronJobs only use kubectl — no internet, database, or cross-service access needed

Details

• Egress allowed: kube-apiserver (10.96.0.1:443) and kube-dns (UDP/TCP 53)
• All other outbound traffic is blocked (database, internet, other cluster services)
• Uses matchExpressions in kilobase to cover both CronJob components in a single policy
• Follows the same pattern as the existing arc-runner-egress NetworkPolicy

Closes #7656

Test plan

• Verify NetworkPolicies exist: kubectl get networkpolicy -n crossplane-system and kubectl get networkpolicy -n kilobase
• Trigger s3-healthcheck manually: kubectl create job --from=cronjob/s3-healthcheck s3-healthcheck-test -n crossplane-system
• Trigger backup-watchdog manually: kubectl create job --from=cronjob/backup-watchdog backup-watchdog-test -n kilobase
• Confirm both jobs complete successfully (kubectl access still works)

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

Scanned Files

None