Fix: 🐛 Use upstream ghcr.io/spiffe/spiffe-helper image for operator sidecar (#501)

* fix: use upstream ghcr.io/spiffe/spiffe-helper image for operator sidecar

The operator's own spiffe-helper sidecar (injected into rossoctl-controller-manager
when spiffe.operatorAuth.enabled=true) pointed at
ghcr.io/rossoctl/cortex/spiffe-helper:latest, which was never published (403
Forbidden on pull) -- the operator pod gets stuck at 1/2 Ready and never
obtains a JWT-SVID, so operator SPIFFE auth never actually authenticates at
runtime even though the bootstrap Job successfully registers the Keycloak
client.

The container's CLI args (-config /etc/spiffe-helper/config.hcl) match the
real upstream SPIFFE project tool exactly, and an earlier branch already used
ghcr.io/spiffe/spiffe-helper:0.11.0 before this regressed to the broken
rossoctl/cortex path. Point it back at the real upstream image.

Assisted-By: Claude (Anthropic AI) <noreply@anthropic.com>
Signed-off-by: Alan Cha <Alan.cha1@ibm.com>

* fix: pin spiffe-helper to v0.11.0 instead of :latest

Unlike authbridge/envoyProxy/authbridgeLite/proxyInit (rossoctl-built images
that default to :latest at the chart level and get pinned by the downstream
rossoctl/rossoctl consumer chart), spiffe-helper is a genuine third-party
upstream dependency with no downstream pin step for it. Tag it directly to
the current latest stable release (ghcr.io/spiffe/spiffe-helper:0.11.0,
confirmed to exist via docker manifest inspect) rather than tracking :latest.

Assisted-By: Claude (Anthropic AI) <noreply@anthropic.com>
Signed-off-by: Alan Cha <Alan.cha1@ibm.com>

---------

Signed-off-by: Alan Cha <Alan.cha1@ibm.com>

Author: Alan-Cha

charts/operator/templates/manager/manager.yaml

@@ -193,7 +193,7 @@ spec:
             {{- end }}
         {{- if and .Values.spiffe .Values.spiffe.enabled .Values.spiffe.operatorAuth .Values.spiffe.operatorAuth.enabled }}
         - name: spiffe-helper
-          image: ghcr.io/rossoctl/cortex/spiffe-helper:latest
+          image: ghcr.io/spiffe/spiffe-helper:0.11.0
           imagePullPolicy: IfNotPresent
           args:
             - "-config"