feat(gateway): expose gatewayAPI.gateway.infrastructure passthrough (#939)

Render Gateway spec.infrastructure (labels/annotations) so Gateway API
controllers propagate the metadata onto the provisioned Service/Deployment,
e.g. AWS internal NLB annotations. Purely additive: guarded by `with`, so
the default {} renders no change.

- spire-lib: toYaml passthrough in the shared Gateway helper
- spire, spire-nested: add the values param; regenerate READMEs
- tests/unit: cover the positive passthrough case

Signed-off-by: sabsari <[email protected]>
Co-authored-by: Claude Opus 4.8 <[email protected]>

tests/unit/spire_test.go

@@ -985,4 +985,21 @@ spire-server:
 			Expect(serverResource).Should(ContainSubstring("name: my-ro-db-secret"))
 		})
 	})
+	Describe("gatewayAPI.gateway.infrastructure", func() {
+		It("passes infrastructure through to the shared Gateway spec when set", func() {
+			objs, err := ValueStringRender(chart, `
+gatewayAPI:
+  gateway:
+    enabled: true
+    className: istio
+    infrastructure:
+      annotations:
+        service.beta.kubernetes.io/aws-load-balancer-scheme: internal
+`)
+			Expect(err).Should(Succeed())
+			gateway := objs["spire/templates/gateway.yaml"]
+			Expect(gateway).Should(ContainSubstring("infrastructure:"))
+			Expect(gateway).Should(ContainSubstring("service.beta.kubernetes.io/aws-load-balancer-scheme: internal"))
+		})
+	})
 })