deploy/chart: add static NetworkPolicies for CatalogSource gRPC ingress and bundle unpack egress (#3863)

* deploy/chart: add static NetworkPolicies for CatalogSource gRPC ingress and bundle unpack egress

The Helm chart's default-deny-all-traffic policy blocked two critical
traffic paths that are not covered by the existing static NetworkPolicies:

1. CatalogSource registry pods need to accept inbound gRPC connections on
   port 50051 from within the cluster. The catalog-operator reconciler
   already creates per-CatalogSource NetworkPolicies for this, but there
   is a bootstrapping gap between when default-deny-all-traffic is applied
   and when the controller first reconciles each CatalogSource.

2. Bundle-unpack Job pods need egress to reach the Kubernetes API server
   and container registries. The API server port is not statically
   specifiable because it varies across Kubernetes implementations, so a
   wildcard egress rule is used.

Adds two new NetworkPolicies to the chart:
- catalog-source-grpc-server: selects all pods carrying the
  olm.catalogSource label and allows ingress on the gRPC port.
- bundle-unpack-egress: selects all pods carrying both the
  olm.managed=true and operatorframework.io/bundle-unpack-ref labels and
  allows unrestricted egress.

Fixes: https://github.com/operator-framework/operator-lifecycle-manager/issues/3676

Signed-off-by: grokspawn <jordan@nimblewidget.com>

* deploy/chart: use catalog_namespace for CatalogSource and bundle-unpack NPs

CatalogSource registry pods and bundle-unpack Jobs run in the namespace
determined by .Values.catalog_namespace, not .Values.namespace. When a
user overrides catalog_namespace to differ from namespace, the
NetworkPolicies must be created in catalog_namespace to actually apply
to those pods.

Fixes review feedback on #3863.

Signed-off-by: grokspawn <jordan@nimblewidget.com>

---------

Signed-off-by: grokspawn <jordan@nimblewidget.com>