WPB-23018 - additional config options for ingress-nginx

[emil-wire]

Add support for custom ingress annotations in the nginx-ingress-services chart via a new ingressAnnotations field. This enables per-environment TLS configuration (such as post-quantum key exchange curves) through server-snippet annotations without modifying the shared ingress-nginx controller.

Checklist

• Add a new entry in an appropriate subdirectory of changelog.d
• Read and follow the PR guidelines

[jschaul]

Looks fine. Note that the main changes for ingress ciphers are here: https://github.com/wireapp/wire-server/blob/develop/charts/ingress-nginx-controller/values.yaml#L46 but I suppose it's on purpose to not modify these.

This needs to be merged and run through its pipelines before you can use it in cailleach.

[emil-wire]

Exactly, I'd like to test a scenario where only the new curves are available to figure out what the potential impact might be and wanted to be fairly surgical where I applied this to keep the blast radius low