Add NetworkPolicies to restrict truenas-csi namespace egress

[mgrzybek]

Context

The truenas-csi namespace (ring0/flux/apps/05-storage/truenas-csi/) hosts the
TrueNAS CSI driver's controller Deployment and node DaemonSet. The node
DaemonSet runs privileged: true with hostNetwork/hostPID/hostIPC and
holds a TrueNAS API key (via the truenas-api-credentials Secret synced by
ExternalSecrets/OpenBao) used to reach the TrueNAS Websocket API.

Some other security-sensitive namespaces in this repo already use
NetworkPolicies to restrict traffic. truenas-csi currently has none, so any
other pod that reaches this namespace's Secret has unrestricted network
access to the TrueNAS admin API.

Task

Add NetworkPolicies for the truenas-csi namespace restricting:

• Egress from truenas-csi-controller/truenas-csi-node to only the
  required destinations (TrueNAS Tailscale endpoint, Kubernetes API).
• Ingress limited to what CSI sidecars require (kubelet, API server).

Follow the same conventions used by other hardened namespaces in this repo
(e.g. idp, cert-manager) for policy structure and Flux placement.

Related

Raised during review of #14 (feat(csi): add initial support for truenas and snapshots).