fix: add healthz port to neuvector services (#1223)

## Description

Issue reported in support channel. After review it seems like Istio
protocol detection was causing the problem and dropping some traffic.
This adds proper protocol detection/listeners on all the neuvector
services and adds a validation to ensure jobs complete in CI.

## Related Issue

N/A

## Type of change

- [x] Bug fix (non-breaking change which fixes an issue)
- [ ] New feature (non-breaking change which adds functionality)
- [ ] Other (security config, docs update, etc)

## Steps to Validate

Can be tested by running an upgrade from 0.34.0 -> this branch.

## Checklist before merging

- [x] Test, docs, adr added or updated as needed
- [x] [Contributor
Guide](https://github.com/defenseunicorns/uds-template-capability/blob/main/CONTRIBUTING.md)
followed

src/neuvector/chart/templates/istio/headless-controller-service.yaml

@@ -28,4 +28,8 @@ spec:
     port: 10443
     protocol: TCP
     targetPort: 10443
-
+  # Upgrade jobs contact the healthz port externally
+  - name: tcp-healthz
+    port: 18500
+    protocol: TCP
+    targetPort: 18500

src/neuvector/chart/templates/istio/headless-enforcer-service.yaml

@@ -21,4 +21,8 @@ spec:
     port: 18401
     protocol: TCP
     targetPort: 18401
-
+  # Upgrade jobs contact the healthz port externally
+  - name: tcp-healthz
+    port: 18500
+    protocol: TCP
+    targetPort: 18500

src/neuvector/chart/templates/istio/headless-scanner-service.yaml

@@ -16,3 +16,8 @@ spec:
     port: 18402
     protocol: TCP
     targetPort: 18402
+  # Upgrade jobs contact the healthz port externally
+  - name: tcp-healthz
+    port: 18500
+    protocol: TCP
+    targetPort: 18500

src/neuvector/tasks.yaml

@@ -41,6 +41,11 @@ tasks:
             protocol: https
             address: neuvector.admin.uds.dev
             code: 200
+      - description: Wait for NeuVector Job Completion
+        cmd: |
+          if ./uds zarf tools kubectl get jobs -n neuvector --no-headers 2>/dev/null | grep -q .; then
+            ./uds zarf tools kubectl wait --for=condition=complete job --all -n neuvector --timeout=5m
+          fi
 
   - name: e2e-test
     actions: