Add skew protection routing mode to Helm chart

[marcopiraccini]

Exposes PLT_SKEW_DEFAULT_ROUTING_MODE so a cluster can choose how clients carry their version for skew protection: cookie (the gateway sets __plt_dpl and matches it back) or query (a ?dpl=<version> baked into the built assets, which the gateway matches).

The chart ships default_routing_mode: query, matching the ICC default. That is a behaviour change for an existing install on upgrade, and it is deliberate: query is the only mechanism both Kubernetes and ECS can implement, so it is the one worth defaulting to. Set cookie if your builds do not pass PLT_DEPLOYMENT_ID yet, since in query mode a version built without its own id gets no pinning rule at all rather than silently falling back to a cookie.

The name says default because it is the cluster default rather than the last word: ICC lets an individual application override it (platformatic/icc-3#975), so a fleet can convert its build pipelines one application at a time instead of flipping everything at once.

Both modes need a Gateway API feature beyond Core, and the guarantees are not equal. Query pinning needs queryParams matching, which is Extended and reported by the conformance suite as HTTPRouteQueryParamMatching. Cookie pinning needs ResponseHeaderModifier to set the cookie, also Extended, plus a RegularExpression header match to read it back, which the Gateway API classifies as Implementation Specific: no conformance feature name, no portability guarantee, no defined regex dialect. Both were verified on Envoy Gateway v1.4.2.

Worth knowing before choosing: the v1.3.0 conformance reports show GKE Gateway does not implement query-parameter matching, and the AWS Load Balancer Controller implements neither feature, so skew protection cannot work through that controller at all. Those are the clusters that need this value set, and they are the ones where the operator did not choose the controller.

The template plumbing follows the existing dig pattern used by the other skew_protection keys, so removing default_routing_mode from values omits the variable entirely and ICC applies its own default.

Verified by rendering the chart: the shipped values produce PLT_SKEW_DEFAULT_ROUTING_MODE: "query", an explicit services.icc.features.skew_protection.default_routing_mode: cookie produces "cookie", and setting the key to null omits the variable.

Requires platformatic/icc-3#975, which implements the routing mode this configures.

[mcollina]

lgtm