Add appProtocol: tcp to Keycloak JGroups ports so the HA test passes on Istio 1.31.1

Summary

Declares the Keycloak JGroups headless-service ports as opaque TCP so Istio does not apply L7 protocol detection to them.

The umbrella injects serviceHeadless.extraPorts for JGroups (7800, 57800) when Istio is enabled, but without an appProtocol:

https://repo1.dso.mil/big-bang/bigbang/-/blob/73462ccaa064f3f141ed95d866f8887218cdc044/chart/templates/keycloak/values.yaml#L157-168

Port 7800 carries JGroups' opaque binary TCP transport, which Istio cannot parse at L7. Without appProtocol, Istio runs automatic HTTP protocol detection on the inbound listener; under Istio 1.31.1 that path no longer propagates the response/close for the plaintext Keycloak HA test probe, so keycloak-script-test (tests/scripts/test-port.py) hangs on recv and fails. Adding appProtocol: tcp makes Istio build a plain tcp_proxy inbound listener (no sniffing), fixing the test. Real peer traffic is mTLS and was unaffected.

Relevant logs/screenshots

Verified on a local k3d umbrella deploy by changing only the Istio version:

• Istio 1.31.1-bb.0, without this change → keycloak-script-test errors: socket.timeout: timed out on sock.recv(1) for port 7800.
• Istio 1.30.4-bb.1, same branch → test passes.
• Istio 1.31.1-bb.0, with this change → headless ports show appProtocol: tcp, inbound 7800 listener is envoy.filters.network.tcp_proxy, and test-port.py passes on both pods:

Running test-port.py...
Connection to <pod-ip-0> on port 7800 was successful
Connection to <pod-ip-1> on port 7800 was successful

Keycloak clustering stayed healthy throughout (both replicas share one JGroups view).

Linked Issue

Closes #3461 (closed)

Upgrade Notices

N/A