Chart: Select NetworkPolicy log-access component by Airflow version

[potiuk]

Follow-up to #67805 (backport of #65754), addressing review feedback: the
1.2x chart line supports both Airflow 2.11 and Airflow 3, so the
NetworkPolicy log-ingress selector must depend on the Airflow version rather
than being replaced outright.

In Airflow 2.11 task logs are served by the webserver; in Airflow 3 they
are served by the api-server. #65754 unconditionally changed the
scheduler / triggerer / worker NetworkPolicy log-ingress from selectors to
component: api-server, which would break task log access on Airflow 2.11
deployments (where no api-server component exists).

This selects the component based on .Values.airflowVersion:

component: {{ if semverCompare ">=3.0.0" .Values.airflowVersion }}api-server{{ else }}webserver{{ end }}

— mirroring how the chart already chooses between the webserver and
api-server components elsewhere (deployments, services, network policies).
The render tests for all three components now cover both Airflow 2.11
(webserver) and Airflow 3 (api-server).

This targets chart/v1-2x-test and should land before the 1.22.0rc1 cut so
the regression never ships.

---

Was generative AI tooling used to co-author this PR?

• Yes — Claude Code (Opus 4.8)

Generated-by: Claude Code (Opus 4.8) following the guidelines

[jscheffl]

Good catch! I assume this has never worked before with the old chart!