fix: pin e2e coraza-waf to a pullable fixed image

The downstream gateway e2e config pinned the WAF filter as the bare tag
`coraza-waf:v1.1.1-dev2`, which has no registry and cannot be pulled in CI,
and predates the TPP Enforce listener-reject / response-phase fixes. The Envoy
listener never programs (Programmed=Unknown), so the
`trafficprotectionpolicy-enforce-serves-traffic` chainsaw test fails on main
and gates every PR.

Point the initContainer at the published, fixed image.

Key changes:
- Pin coraza-waf initContainer to
  ghcr.io/datum-labs/coraza-envoy-go-filter/coraza-waf:v1.3.0-alpha10

Author: ecv

config/dev/downstream_resources/downstream-gateway.yaml

@@ -63,7 +63,7 @@ spec:
               mountPath: /opt/coraza-waf
         initContainers:
           - name: coraza-waf
-            image: coraza-waf:v1.1.1-dev2
+            image: ghcr.io/datum-labs/coraza-envoy-go-filter/coraza-waf:v1.3.0-alpha10
             imagePullPolicy: IfNotPresent
             command:
               - cp