feat(shield): gate nodes/proxy on live_logs in host ClusterRole

[francesco-furlan]

What this PR does / why we need it

Removes the unconditional nodes/proxy grant from the host-shield ClusterRole — flagged as a Remote Code Execution vector by security scans because it proxies arbitrary requests to the kubelet API.

The permission is now feature-gated: it is only granted when features.investigations.live_logs.enabled: true (default false).

Behaviour

features.investigations.live_logs.enabled	nodes/proxy granted
false (default)	no
true	yes

Files changed

• templates/host/clusterrole.yaml — remove nodes/proxy from the base rule; add it back behind live_logs.enabled.
• tests/host/clusterrole_test.yaml — 3 new cases: default=no grant, live_logs=true=grant, live_logs=false=no grant.
• Chart.yaml — bump 1.42.1 → 1.43.0.

Test plan

• helm unittest -f 'tests/**/*_test.yaml' . — 37/37 suites, 552/552 tests pass (3 new).
• helm template with defaults → host ClusterRole has no nodes/proxy.
• helm template --set features.investigations.live_logs.enabled=true → nodes/proxy present.

Checklist

• Title of the PR starts with type and scope (feat(shield):)
• Chart version bumped (1.42.1 → 1.43.0)
• All test files are added in the tests folder with a _test suffix

Note: this is a reduced-scope follow-up to #2608. Version-aware K8s detection and host.rbac.kubelet_authorization_mode are deferred to a future PR once the live_logs refactor for nodes/log is complete.