Locust Kubernetes Operator v2.3.0

⚠️ Upgrade Notes ⚠️

Kubernetes 1.29+ now required: The metrics exporter now runs as a native sidecar container, so the chart's kubeVersion constraint has been raised to >= 1.29.0-0 (#327)

Finished tests now actually finish: The metrics exporter now runs as a native sidecar, so the master Job completes instead of running forever and the LocustTest reaches Succeeded. Thanks @BackSlasher! (#327, commit 0788524)
RuntimeClass support: Run Locust pods (and the operator itself) under gVisor, Kata Containers, or any other RuntimeClass, per-test via the CR or operator-wide via chart values. Closes #293 (#336, commit 70a962a)

Recovery loop on CR names containing dots: Lookups now use the same sanitized names the builders create, and finished tests can no longer be resurrected as Pending. Closes #50. Thanks again @BackSlasher! (#326, commit 551272f)
Webhook volume-name validation on dotted CR names: Generated-name computation is now shared between the webhook and the resource builders, ending both false rejections and a missed genuine collision (#341, commit 0d17837)

Go & x/net CVE fixes: Bumped Go to 1.26.5 and golang.org/x/net to v0.55.0, clearing all CVEs flagged by the security scan. Closes #328 (#335, commit 0f4e63d)
gRPC & cel-go advisories: Bumped google.golang.org/grpc to v1.82.1 and cel-go to v0.29.0, resolving GHSA-hrxh-6v49-42gf and GHSA-gcjh-h69q-9w9g (#345, commit 2671327)
Trivy severity threshold now enforced: The scheduled scan no longer fails on findings below the declared CRITICAL,HIGH threshold (#346, commit 36267eb)

New how-to guide: Use a runtime class, sandboxing Locust pods with gVisor or Kata Containers (#336)
Stale Kubernetes version references fixed: Cleaned up leftover 1.27/1.28 references across docs and comments. Thanks @BackSlasher! (#337, commit 82801df)

Native-sidecar exit-code policy codified: Sidecar termination exit codes are teardown noise, not failures. Now expressed once as resources.IsNativeSidecar and covered by tests. Thanks @BackSlasher! (#338, commit 5478a71)
E2E webhook readiness gate fixed: The suite now waits for the webhook to actually serve traffic, ending intermittent connection refused failures (#342, commit b13b904)
chore(deps): bump github.com/onsi/gomega from 1.39.1 to 1.41.0 by @dependabot[bot] in #324
chore(deps): bump Go test/logging deps and pinned GitHub Actions by @AbdelrhmanHamouda in #347
chore(deps): bump kubernetes group to v0.36.3 and controller-runtime to v0.24.1 by @AbdelrhmanHamouda in #348

A warm welcome to @BackSlasher, who made their first contribution in #327 and followed it up with #326, #337, and #338. Sharp diagnoses, real-cluster evidence, and fixes for bugs dating back to #50. Welcome aboard! 🎉