feat: add GitLab webhook verification support

[bornakapusta]

Summary

• Add gitlab verifier type for GitLab webhook authentication via X-Gitlab-Token header
• Add predefined GitLab.com IP allowlist for webhook source IPs (34.74.90.64/28, 34.74.226.0/24)
• Add test routes for all verifier types in minikube config

Test plan

• Unit tests pass (internal/verifier/gitlab_test.go)
• Manual test with minikube using /direct/gitlab and /relay/gitlab routes

🤖 Generated with Claude Code

[nickmarden]

@bornakapusta can you resolve this merge conflict? I'd love to be able to merge this.

[github-actions]

Docker Images Built

Images are available for testing:

# gatekeeperd
docker pull ghcr.io/tight-line/gatekeeperd:pr-19-f46d1cc

# gatekeeper-relay
docker pull ghcr.io/tight-line/gatekeeper-relay:pr-19-f46d1cc

docker-compose.yml

GATEKEEPERD_IMAGE=ghcr.io/tight-line/gatekeeperd:pr-19-f46d1cc \
RELAY_IMAGE=ghcr.io/tight-line/gatekeeper-relay:pr-19-f46d1cc \
docker-compose --profile relay up

Helm (values override)

image:
  repository: ghcr.io/tight-line/gatekeeperd  # or gatekeeper-relay
  tag: "pr-19-f46d1cc"

Images expire ~15 days after PR closes.

[nickmarden]

@bornakapusta can you fix up the coverage? Ideally we shoot for 100% coverage on new (testable) code.

The repo has some instructions about how to mark code as untestable, but really that should be a feature of last resort. Most code is testable. We currently only use that feature for Redis testing because our Redis testing library lacks some features of a real Redis server.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
100.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!