Define opt-in Alloy egress to Cortex Tenant

General MR

Summary

• Keep the alloy-metrics to Cortex Tenant TCP 8080 egress rule defined in package values, disabled by default.
• Test the generated source and destination selectors when the rule is explicitly enabled.
• Bump the wrapper chart to 4.3.2-bb.2, update the changelog and integration guide, and regenerate the README.

Relevant logs/screenshots

• helm lint ./chart passed.
• helm unittest chart/ -f "unittests/**/*_test.yaml" passed (6 tests).
• Helm render confirms the Cortex Tenant policy is absent by default and present when enabled.
• The Cortex Tenant package CI overlay explicitly enables the policy for end-to-end delivery.

Linked Issue

big-bang/bigbang#3464 (closed)

Umbrella Branch

alloy-cortex-tenant-prewiring

Upgrade Notices

For a standalone Alloy deployment writing through Cortex Tenant, enable networkPolicies.egress.from.alloy-metrics.to.k8s.cortex-tenant/cortex-tenant:8080. The Big Bang umbrella enables this connection when its Cortex Tenant destination is selected.