feat: add header manipulation API for security profiles

[furykerry]

Summary

• Add HeaderManipulationAction and HeaderValue types to SecurityRuleActions, enabling set/remove of plaintext request headers on matching egress requests
• Expand annotation constants (cleanup, priority, sandbox hash) and introduce dedicated labels.go for label constants
• Update SecurityProfile and GlobalSecurityProfile CRD schemas, checkpoint types, and sandbox types
• Sync Java SDK and Python SDK models with the new API types

Test Plan

• go vet ./... passes (pre-existing runtime/config.go lock-copy warning is unrelated to this PR)
• CRD schemas validate against the updated types
• Java/Python SDK models compile without errors

[kruise-bot]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment