feat: add dedicated gRPC URL configuration for Cilium Gateway API compatibility

[christianhuth]

The problem

The Netbird operator's primary use case is exposing Kubernetes services to the Netbird network via NetworkResource and NetworkRouter. The NetworkRouter pods connect to the Netbird management platform via gRPC, using NB_MANAGEMENT_URL derived from the operator's managementURL (if I understand this correct). Since managementURL is also used for REST API calls (/api/*), a single URL must serve both traffic types.

This creates a hard conflict when the self-hosted management platform runs on Cilium with Gateway API — which is increasingly common given Cilium's position as the most widely deployed CNI in production Kubernetes. Cilium requires that a GRPCRoute and an HTTPRoute be attached to separate Gateway listener sections. When they share a listener, Cilium's translator generates a broken filter chain that blocks external gRPC connections (see KitStream/helms#106 for full technical details and the self-hosted chart workaround).

The correct Cilium setup therefore exposes gRPC on a dedicated hostname (e.g. netbird-grpc.example.com) and REST on the original hostname (e.g. netbird.example.com). Because the operator cannot be configured with separate URLs, the NetworkRouter continues to connect to the original shared hostname — forcing a messy dual-listener workaround on the management side just to accommodate this limitation.

The suggested fix

Add an optional managementGrpcURL field to the operator. When set, gRPC connections (used by NetworkRouter) use this URL; REST API calls continue to use managementURL. When unset, current behaviour is preserved.

managementURL: https://netbird.example.com:443
managementGrpcURL: https://netbird-grpc.example.com:443

This allows a clean Cilium-compatible deployment where the dedicated gRPC listener serves only GRPCRoute traffic, with no workarounds required on the management platform side.