[usage] Add network policy to allow ingress from server

[andrew-farries]

Description

Add a network policy for the usage component so that it accepts incoming gRPC connections from server (and no other components).

Related Issue(s)

Part of #9036

How to test

1. Open a preview environment and install the kubecontext for this branch:

previewctl install-context

2. Run an ubuntu pod in the default namespace.

kubectl run ubuntu -it --image ubuntu -- /bin/sh

3. Install a grpc client like evans or grpcurl into the container.

4. Try to connect from the ubuntu pod to the usage service:

./evans --host usage -p 9001 -r repl

See that it fails.

5. Label the ubuntu pod:

kubectl label pod ubuntu component=server

6. Try the same evans command from inside the ubuntu container.

This time the connection succeeds because the pod is labelled correctly for the network policy to allow ingress.

Release Notes

NONE

Werft options:

• /werft with-preview

[werft-gitpod-dev-com]

started the job as gitpod-build-af-access-usage-api-from-server.4 because the annotations in the pull request description changed
(with .werft/ from main)

[andrew-farries]

/hold

[geropl]

/werft run

👍 started the job as gitpod-build-af-access-usage-api-from-server.5
(with .werft/ from main)

Random werft error

[geropl]

Code LGTM, tested and works.

/unhold

[easyCZ]

@geropl You landed this into the parent PR. Sometimes, it's easier to wait for the parent to land and land this directly on top - requires less reviews

[geropl]

Oh. I feel we should make this explicit, then. Either in the description, or better by adding an (explicit) label.