feat: experimental opt-in classification banner

[mjnagel]

Description

This PR adds an experimental (opt-in) classification banner provided via an envoyfilter. This filter injects html/script code to add a top (and optionally bottom) banner with the desired classification level and the expected colors. This has primarily been validated against Keycloak and Grafana, other UIs may not display perfectly (part of why this is noted as experimental).

Related Issue

Fixes #1079

Type of change

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Other (security config, docs update, etc)

Steps to Validate

1. Modify the slim-dev bundle to add the below overrides:

    overrides:
      istio-controlplane:
        uds-global-istio-config:
          values:
            - path: classificationBanner.text
              value: "UNCLASSIFIED" # Possible values: UNCLASSIFIED, CUI, CONFIDENTIAL, SECRET, TOP SECRET, TOP SECRET//SCI, UNKNOWN
            - path: classificationBanner.addFooter
              value: true
            - path: classificationBanner.enabledHosts
              value:
                - keycloak.admin.{{ .Values.domain }}
                - sso.{{ .Values.domain }}

2. Deploy slim-dev: uds run slim-dev --set flavor=unicorn
3. Validate that the banner with the expected classification level appears on the Keycloak admin and tenant interfaces and does not overlap with any content.

Checklist before merging

• Test, docs, adr added or updated as needed
• Contributor Guide followed

[UnicornChance]

lgtm