fix(traefik): listen on port 443 directly for Gateway API compatibility

Traefik matches Gateway listener ports against entryPoint internal ports.
websecure was on 8443 so port 443 listeners were rejected as PortUnavailable.

Change websecure to listen on 443 and add NET_BIND_SERVICE capability to
allow binding to privileged ports as a non-root user.

apps/overlays/au-syd1/traefik-system/values-external.yaml

@@ -82,4 +82,15 @@ podSecurityContext:
   seccompProfile:
     type: RuntimeDefault
 
+securityContext:
+  allowPrivilegeEscalation: false
+  capabilities:
+    drop: [ALL]
+    add: [NET_BIND_SERVICE]
+  readOnlyRootFilesystem: true
+
+ports:
+  websecure:
+    port: 443
+
 enabled: true

apps/overlays/au-syd1/traefik-system/values-internal.yaml

@@ -82,4 +82,15 @@ podSecurityContext:
   seccompProfile:
     type: RuntimeDefault
 
+securityContext:
+  allowPrivilegeEscalation: false
+  capabilities:
+    drop: [ALL]
+    add: [NET_BIND_SERVICE]
+  readOnlyRootFilesystem: true
+
+ports:
+  websecure:
+    port: 443
+
 enabled: true