feat(base): support additional TLS listeners for SNI-based multi-cert gateways

[serialito74]

Problem

gateway.internal and gateway.public each template a single HTTPS listener bound to one cert (tls.secretPrivateName / tls.secretName). When the hostnames routed through a Gateway are covered by more than one certificate with disjoint SANs — e.g. two separate corporate wildcard certs for different subdomains — there is no supported way to serve them all from the same Gateway.

Change

Adds an optional gateway.internal.extraListeners / gateway.public.extraListeners list. Each entry:

gateway:
  public:
    extraListeners:
      - name: https-extra
        hostname: "*.extra.example.com"
        secretName: "wildcard-tls-extra"

renders as an additional port: 443, protocol: HTTPS listener on that Gateway, cert selected by SNI. Empty by default — existing deployments are unaffected.

• charts/base/values.yaml: extraListeners: [] under gateway.internal and gateway.public, with docs.
• charts/base/templates/gateways.yaml: range block appended to each Gateway's listeners.
• No Chart.yaml version bump (leaving that to release-please).

Verification

• helm lint charts/base → passes.
• helm template charts/base --show-only templates/gateways.yaml with extraListeners set → renders the extra HTTPS/443 listeners on the correct Gateways with the right certificateRefs.
• With extraListeners unset/empty → output identical to before (no regression).