feat(kubevirt): move virt-handler to hostNetwork, bump 3p-kubevirt fork version

[yaroslavborbat]

Description

Bumps the 3p-kubevirt fork version to include changes from deckhouse/3p-kubevirt#93 and updates Helm templates accordingly.

Changes in the kubevirt fork (3p-kubevirt#93):

• virt-handler is moved to hostNetwork: true.
• Metrics endpoints are protected with native Kubernetes authn/authz (RBAC) middleware — replaces the kube-rbac-proxy sidecar.
• A kube-api-rewriter round tripper is added to virt-handler and virt-controller

Changes in Helm templates:

• virt-handler DaemonSet is configured with hostNetwork: true via customizeComponents.patches.
• Removed now-redundant kube-rbac-proxy sidecar for virt-handler, virt-controller, virt-api, virt-operator
• Removed now-redundant kube-api-rewriter sidecar for virt-handler, virt-controller.
• Added centralized port constants for all DaemonSets running with hostNetwork (virt-handler, vm-route-forge, virtualization-dra) — ports are chosen outside the KubeVirt live-migration range (4135–4199).

Why do we need it, and what problem does it solve?

Previously virt-handler ran without hostNetwork, which required a kube-rbac-proxy sidecar to secure the metrics endpoint. Moving to hostNetwork aligns virt-handler with the other node-level DaemonSets (vm-route-forge, virtualization-dra) and eliminates the extra sidecar. Native authn/authz middleware and the kube-api-rewriter round tripper built into the fork replace the proxy, reducing resource overhead and operational complexity.

What is the expected result?

1. Deploy the module with the updated Helm templates.
2. Verify virt-handler pods start with hostNetwork: true and no kube-rbac-proxy, kube-api-rewriter sidecar.
3. Verify metrics are accessible and protected by RBAC.
4. Verify live-migration still works (ports 4135–4199 are unaffected).

Checklist

• The code is covered by unit tests.
• e2e tests passed.
• Documentation updated according to the changes.
• Changes were tested in the Kubernetes cluster manually.

Changelog entries

section: vm
type: fix
summary: "Optimized virtual machine migration: it now uses `hostNetwork`, allowing the host MTU to be used instead of the pod MTU."

[yaroslavborbat]

deckhouse/deckhouse#19237