fix: add validation to prevent invalid ReferenceGrant resources

[Copilot]

The ReferenceGrant template creates invalid Kubernetes Gateway API resources when envoy.referenceGrant.from or envoy.referenceGrant.to are empty or undefined. Gateway API spec requires both fields to have at least one entry.

Changes

• Added conditional logic to skip ReferenceGrant creation when from or to arrays are empty
• Extract arrays into variables with default list to safely check their length
• Template now only renders when envoy.enabled is true AND both arrays contain at least one element

# Before: Creates invalid resource with empty from/to
envoy:
  enabled: true
  referenceGrant: {}

# After: Skips ReferenceGrant creation when arrays are empty
# Only creates resource when properly configured:
envoy:
  enabled: true
  referenceGrant:
    from:
      - kind: HTTPRoute
    to:
      - kind: Gateway
        name: gateway-api

Existing required validations on kind fields remain active to catch misconfigured entries.

---

✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.

[Copilot]

Just as a heads up, I was blocked by some firewall rules while working on your feedback. Expand below for details.

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• charts.bitnami.com
  • Triggering command: /usr/local/bin/helm helm dependency update parcellab/microservice (dns block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)