fix(base): pin CRD installer image and grant admissionregistration RBAC

[Bautibianco]

Summary

• install-gateway-api-crds (the pre-install,pre-upgrade hook Job) fails with BackoffLimitExceeded once global.gatewayApiCrdRef is bumped past the default v1.3.0, for two independent reasons:
  1. docker.io/bitnami/kubectl:latest currently resolves to a build whose bundled OpenSSL 3.5.x fails to generate the ML-KEM-768 key share during the TLS 1.3 handshake with github.com (error:078C0103:...genkey:internal error while generating ML-KEM-768 private key), aborting the kubectl kustomize github.com/... fetch before any CRD is applied. This is a regression introduced by the latest tag itself (floating), not by the chart — it was pinned to 1.31 before fix(base): update bitnami/kubectl image tag from 1.31 to latest #140 moved it to :latest. This PR pins it to docker.io/bitnamilegacy/kubectl:1.31.4, a stable tag on Bitnami's legacy registry unaffected by the regression.
  2. Gateway API CRD refs >= v1.4.0 ship a ValidatingAdmissionPolicy (safe-upgrades.gateway.networking.k8s.io) alongside the CRDs. The nullplatform-crd-installer ClusterRole only grants apiextensions.k8s.io/customresourcedefinitions, so kubectl apply fails with Forbidden on validatingadmissionpolicies/validatingadmissionpolicybindings. This PR adds the missing admissionregistration.k8s.io rule.

Why not just bump gatewayApiCrdRef back to v1.3.0?

That sidesteps the RBAC issue but not the image issue — bitnami/kubectl:latest can regress again at any time since it's a floating tag. Pinning it is the durable fix regardless of which CRD ref is configured.

Test plan

• Reproduced both failures against a live EKS cluster with gatewayApiCrdRef=v1.5.1:
  • Ran the exact failing command (kubectl kustomize ... | kubectl apply ...) in a debug pod using the current :latest image — confirmed the TLS/ML-KEM error in the pod logs.
  • Ran it again with docker.io/bitnamilegacy/kubectl:1.31.4 — CRD fetch/apply succeeded, then hit the Forbidden error on validatingadmissionpolicies.
  • Applied both patches locally, repackaged the chart, and ran helm upgrade against the real release — completed successfully (STATUS: deployed), Job Completed, all 8 Gateway API CRDs (including the 4 new ones: backendtlspolicies, grpcroutes, listenersets, tlsroutes) present on the cluster.

🤖 Generated with Claude Code

https://claude.ai/code/session_01F4iyAKjdPBB8jvEMLGimYJ