feat(enterprise): allocate a LoadBalancer IP pool for the Advisor web console

[traviswu-bigstack]

What type of PR is this?

/kind feature

What this PR does / why we need it

The advisor was allocated exactly one LoadBalancer address. Its web console proxies an operator's browser to the cluster's own web UIs, each on its own browser origin — and in the offline deployment model, which cannot be assumed to have any DNS we can configure, each origin is a pinned IP address.

That is forced, not preferred. Browsers separate cookie jars by host and by nothing else: RFC 6265 ignores port entirely, and a path-based scheme needs URL rewriting that breaks the OIDC flow. So a cluster needs the advisor's own address plus one per distinct upstream the console reaches.

• lbIPProbe → lbIPPoolProbe, returning up to N free addresses instead of the first one. The existing machinery was already the right shape — it walks the subnet's allocation pool skipping neutron-held addresses and ARP-probes the survivors — so this generalises without a redesign.
• The install form is offered the whole pool (ClusterQuery.SuggestedAdvisorPool), from the same probe that produces the LB-IP suggestion.
• Preflight ARP-probes every pool address, not just the framework's LB IP.
• install-advisor.sh renders them as webConsole.origins[], and every pool address joins the certificate's SANs.

Which issue(s) this PR fixes

Fixes #105

Special notes for your reviewer

CMP and its Keycloak share one origin, deliberately. They sit behind the same framework ingress, so they share an upstream — and advisor-api refuses a config where two origins share one (webconsole: upstream %q is also used by origin with upstream %q). They would have to share an origin even if it allowed it: split across two, the OIDC state cookie is set on one origin and the callback arrives at the other, which is a broken login that reads as a proxy bug. The two constraints agree, which is a good sign the model is right.

Target names are the node's, not the chart's. The chart's commented example uses cmp-portal, cmp-idp, dashboard. Those are not the names cubecos allows — cube-cmp, app-fw-idp, cube-cos (bigstack-oss/cubecos#1482) — and a name the node does not allow is a target the agent refuses to dial. A test fails if the example names ever appear here.

Why the pool is asked for whole, up front. Every address becomes a SAN on the advisor's serving certificate, and advisor-api refuses to enable a console whose certificate does not cover an origin address, naming the uncovered one. Adding an address later therefore means reissuing that certificate, not editing a value — hence advisorPoolSize = 5 (floor is 3: advisor + ingress + the node's dashboard) rather than the minimum.

Backwards compatible. The pool is a 5th positional argument to the install script and is quoted, so an empty pool still occupies its slot rather than shifting every later argument — a test pins both the populated and empty forms. An install that passes no pool leaves the console off, exactly as today.

A reused certificate is refused when it does not cover the pool. #111 landed first and brought the TLS keypair's reuse-on-re-run behaviour with it, which interacts with this directly: a certificate issued before an address joined the pool does not cover it, and advisor-api would then refuse to enable the console. Rather than install a console that cannot start, the script now checks each pool address against the reused certificate and fails naming the address, telling the operator to delete cube-advisor-web-tls to reissue — and warning that every browser which has accepted this advisor will challenge it once more. That is the cost the pool's headroom exists to avoid paying.

Not verified on hardware. The probe and the rendering are covered by unit tests only. The lab advisor is installed with a single address and re-running the installer against it would reissue its serving certificate, which every browser that has accepted it would then challenge. Worth a clean-cluster run before this leaves draft.

Additional documentation

AdvisorPool — web-console origin addresses, one per distinct upstream the
              console reaches. Empty leaves the web console off.