Implement synapse-waf Helm chart

[NickCrew]

Description

Build the WAF sensor chart for Kubernetes operators. The chart should keep the reverse-proxy/admin split explicit: proxy traffic may be exposed intentionally, while admin and metrics stay internal unless the operator opts in.

The chart should support ConfigMap or Secret-backed configuration, telemetry to Fleet, and future observability integrations such as Prometheus ServiceMonitor.

Acceptance Criteria

• Migrate synapse-waf to Rust 2024 edition #1 Chart deploys Synapse WAF with configurable image, config.yaml source, resources, probes, service account, and pod security settings
• Cache parsed EvalContext data across body-phase and deferred WAF passes #2 Proxy, admin, health, and metrics services are configurable with admin/metrics ClusterIP by default
• Instantiate and integrate HeaderProfiler for per-endpoint header anomaly detection #3 Chart supports telemetry wiring to Synapse Fleet through endpoint and secret-backed API key values
• Escalate invalid-session weight non-linearly to catch faster brute-force #4 Chart supports Deployment by default and documents when DaemonSet mode is appropriate

---

Migrated from backlog TASK-103.4 (synapse).