Add Contour HTTPProxy ingress example for Workbench

[samcofer]

Summary

• Adds a Workbench ingress example that uses Contour's HTTPProxy CRD (rendered via extraObjects) instead of the chart's templated Ingress. Contour's Ingress annotations don't expose cookie-based session affinity, which Workbench requires when running more than one replica.
• The HTTPProxy wires up TLS, websockets (RStudio IDE / VS Code / Positron / Jupyter / job streaming), long timeouts, and the X-Forwarded-Proto / X-RStudio-Request headers Workbench needs behind a TLS-terminating proxy.
• Style matches the existing nginx / traefik / alb examples: shared license + storage + database boilerplate, workbench.example.com and posit-workbench-tls placeholders, inline # TODO: markers, and a minimal .qmd that includes _prereqs.qmd.

Why this matters beyond Posit users

This also lines up with SAS Viya's stated direction for Kubernetes ingress. Per the SAS Viya 2025.12 release notes:

An ingress controller that the SAS Viya platform supports for deployment, ingress-nginx (or Ingress NGINX controller), is being retired by the Kubernetes community.
You can replace ingress-nginx with Contour ingress controller.
Starting March 19, 2026, SAS provides support for Contour in all Stable and Long-Term Support (LTS) releases of the SAS Viya platform.

Customers who run Posit Workbench alongside SAS Viya on the same cluster were previously stuck either running two ingress controllers or hand-rolling an HTTPProxy. This example gives them a documented Posit-supported pattern that drops cleanly into the same Contour install SAS Viya is being migrated onto.

Test plan

• helm template demo charts/rstudio-workbench -f examples/workbench/ingress/rstudio-workbench-contour-ingress.yaml renders cleanly with no leftover {{ }} outside the launcher template ConfigMap
• kubectl apply --dry-run=server accepts the rendered HTTPProxy
• End-to-end install on EKS + upstream Contour: HTTPProxy reports STATUS: valid, HTTPS root → 302 to /auth-sign-in, sign-in form returns 200, websocket upgrade headers pass through to Workbench