vmalertmanagerconfig: add incidentio_config file-based properties support

[AndrewChubatiuk]

fixes #2222

---

Summary by cubic

Add file-based incident.io config to VMAlertmanagerConfig via url_file and alert_source_token_file, so URL and token can be read from files. Enforces mutual exclusivity with existing fields and disallows token file when arbitrary FS access is restricted (fixes #2222).

• New Features
  • Added url_file and alert_source_token_file to IncidentioConfig; mutually exclusive with url and alert_source_token.
  • Controller writes these fields into Alertmanager config; validation blocks alert_source_token_file when arbitrary FS access is disabled.
  • Updated CRD schema/docs and CHANGELOG; added test for file-based fields.

^{Written for commit 63c234b. Summary will update on new commits.}

Review in cubic

[cubic-dev-ai]

1 issue found across 4 files

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="api/operator/v1beta1/vmalertmanagerconfig_types.go">

<violation number="1" location="api/operator/v1beta1/vmalertmanagerconfig_types.go:1498">
P2: Missing URLFile block in arbitrary FS validation. `url_file` still allows file-path based config when deny mode should reject file-based inputs. Add URLFile check in `validateArbitraryFSAccess()`.</violation>
</file>

<sub>Reply with feedback, questions, or to request a fix.

Fix all with cubic | Re-trigger cubic</sub>