fix(helm): use native gRPC probe on relay :4222 and bump default to v1.19.5

[slariviere]

Closes #2165

Address review comments from #2282 (closed due to inactivity)

Summary

Fixes hubble-relay's startup/readiness/liveness probes, which fail on Cilium
v1.16+ images because the grpc_health_probe binary used by the legacy
exec-based probe was removed upstream (cilium/cilium#37806).

1. templates/hubble-relay/deployment.yaml — single native grpc: probe
   against the relay's dedicated health server (hubble.relay.grpcHealthPort,
   default 4222), replacing the k8s-version-gated exec/native branching.
   The health listener is always plaintext regardless of hubble.tls.enabled
   (only the main API on listenPort is TLS-wrapped), so this probe works in
   both TLS and non-TLS deployments. Also renders the relay image via the
   cilium.image helper (previously a raw repository:tag string) so
   useDigest/override are actually honored.
2. templates/hubble-relay/configmap.yaml — wires hubble.relay.grpcHealthPort
   through to health-listen-address, so the relay's health server actually
   listens on the port the probes target.
3. templates/hubble-ui/deployment.yaml — frontend and backend images now
   also render via the cilium.image helper.
4. values.yaml:
   • hubble.relay.image default bumped from
     mcr.microsoft.com/oss/cilium/hubble-relay:v1.15.0 to
     quay.io/cilium/hubble-relay:v1.19.5 (matches the Cilium v1.19.3
     dependency in go.mod), with useDigest: true.
   • Added hubble.relay.grpcHealthPort: "4222".
   • hubble.ui.backend.image and hubble.ui.frontend.image both moved from
     mcr.microsoft.com to quay.io/cilium/hubble-ui{,-backend}:v0.13.5
     (previously split across two registries at v0.12.2), matching upstream
     Cilium's v1.19.5 chart image pins.

[nddq]

lgtm, thanks!

[nddq]

@slariviere All commits need to have verified signatures

[slariviere]

@nddq should be good now