fix(chart): fail rendering instead of opening the port when a policy rule has no peers

[rtrompier]

The bug

Same fail-open an automated review caught in a sibling chart. With networkPolicy.ingress.enabled: true and allowedBlocks left at its default (empty), the template rendered a rule whose from list was empty — and a rule with an empty from matches every source (Kubernetes NetworkPolicy semantics). So the port would be open to the whole cluster and VPC while the policy still looks restrictive.

Where this chart also has an internal-egress rule fed by a list, the same applies in reverse: an empty list renders to: empty, which matches every destination.

The fix

• ingress: rendering now fails with an explicit message when the restriction is enabled without addresses. Failing loudly is deliberate — silently dropping the rule would black-hole traffic with no explanation, silently rendering it opens the port, and only an error cannot be mistaken for success.
• internal egress: the rule is now conditional on its list being non-empty, so an empty list means "no internal destination allowed" (fail-closed) rather than "all destinations allowed".

Not currently exploitable

The live deployment supplies non-empty lists, so nothing is open today — the bug was latent, waiting for a new environment or a typo.

Verified

• restriction enabled without addresses → render aborts with the message
• production values → renders unchanged, and no rule ends up with an empty peer list