Cluster charts: defaultNetworkPolicies.mode and rollout gating

[weatherhog]

Part of #4338.

• giantswarm/cluster: bump network-policies pin (currently 0.1.3), plumb new mode into app values
• Per provider (cluster-aws, cluster-azure, cluster-vsphere, cluster-cloud-director, …): global.connectivity.network.defaultNetworkPolicies.mode: all-namespaces | gs-namespaces | none in values + schema; extend templates/_network-policies_helmrelease_config.yaml
• Map deprecated global.connectivity.network.allowAllEgress: true → mode: none with schema deprecation warning
• Default all-namespaces lands in a new major release with loud upgrade notes; coordinate Release promotion (release-operator) — Turtles review for cluster chart changes