Please ensure your pull request adheres to the following guidelines:

• For first time contributors, read Submitting a pull request
• All code is covered by unit and/or runtime tests where feasible.
• All commits contain a well written commit description including a title,
  description and a Fixes: #XXX line if the commit addresses a particular
  GitHub issue.
• If your commit description contains a Fixes: <commit-id> tag, then
  please add the commit author[s] as reviewer[s] to this issue.
• All commits are signed off. See the section Developer's Certificate of Origin
• Provide a title or release-note blurb suitable for the release notes.
• Disclose use of machine learning models (including LLMs and other generative AI)
  in accordance with the Cilium AI Policy, and indicate the rating using
  AI Influence Level.
  This PR was prepared with AIL:3. I personally reviewed the change, checked the
  rendered Service for every combination of the new values, and ran the chart lint
  and the values and schema checks.
• Thanks for contributing!

Before: the shared cilium-ingress Service always carries port 80 next to port 443, and no Helm value removes it. On a cloud provider that means the load balancer always comes up with a plain HTTP listener. Where an organization's policy forbids HTTP listeners, that load balancer gets deleted by an automated sweep, so Cilium Ingress is unusable without a mutating admission policy that patches the Service after Helm has written it. That is what the issue reporter ended up doing.

After: two new values, ingressController.service.insecurePortEnabled and ingressController.service.securePortEnabled, decide whether each port is listed on the shared Service. Both default to true, so an existing install renders exactly the Service it rendered before. With insecurePortEnabled: false only the HTTPS port is left and the load balancer comes up without an HTTP listener.

How: the two port entries in cilium-ingress-service.yaml are guarded by the matching value, and validate.yaml rejects an install that turns both off, since a Service needs at least one port. values.yaml, values.schema.json, the chart README and the Helm reference are regenerated with the repo tooling.

On naming, since this is filed as a CFP: insecurePortEnabled and securePortEnabled follow insecureNodePort and secureNodePort, which already sit next to them under ingressController.service. I am happy to rename them if you prefer a different shape, for example a single list of ports.

Scope: this covers shared mode, which is the Service the issue is about. Dedicated mode Services are built by the operator, and getService in operator/pkg/model/translation/ingress/dedicated_ingress.go already omits port 80 for a TLS only Ingress.

Verified on this branch:

• helm template with ingressController.enabled=true and no other flags renders the same Service and EndpointSlice as main. Diffing the full chart output before and after the change shows no difference outside the generated certificates.
• insecurePortEnabled=false renders only the https port, securePortEnabled=false renders only the http port, and both together fail with the message from validate.yaml.
• type=NodePort with insecurePortEnabled=false and secureNodePort=30443 still puts the node port on the remaining entry.
• hostNetwork.enabled=true with insecurePortEnabled=false renders a ClusterIP Service with only the https port.
• make -C install/kubernetes lint and make -C install/kubernetes check-values-yaml both pass, and rerunning helm-docs, helm-schema and the Documentation update-helm-values target produces no further diff.

Fixes: #48108

Add ingressController.service.insecurePortEnabled and ingressController.service.securePortEnabled to control whether the shared Cilium Ingress Service exposes port 80 and port 443.