Add v1.7.4 release notes

Signed-off-by: Karol Szwaj <karol.szwaj@gmail.com>

Author: cnvergence

release-notes/v1.7.4.yaml

@@ -0,0 +1,28 @@
+date: Pending
+
+# Changes that are expected to cause an incompatibility with previous versions, such as deletions or modifications to existing APIs.
+breaking changes: |
+
+# Updates addressing vulnerabilities, security flaws, or compliance requirements.
+security updates: |
+  Fixed xDS server authentication bypass in GatewayNamespaceMode, adding Unary Interceptor and validating SotW requests.
+
+# New features or capabilities added in this release.
+new features: |
+
+bug fixes: |
+  Fixed TLS secrets with non-canonical PEM formatting (e.g. unusual line endings) being passed verbatim to Envoy, which could cause BoringSSL errors such as `BAD_END_LINE`. Cert and key PEM data is now re-encoded to a canonical form before being delivered as xDS resources.
+  Fixed the xDS server in GatewayNamespaceMode serving a stale certificate after cert-manager rotation by re-reading the cert from disk on every TLS handshake.
+  Fixed Gateway getting stuck at `Programmed=False` after its LoadBalancer Service IP was restored, by ignoring `LastTransitionTime` when comparing status conditions.
+  Fixed HPA maxReplicas required message typo in gateway-helm chart.
+  Fixed BackendTLSPolicy selection to prefer section name over wildcard match on the same backend.
+  Fixed invalid listeners blocking valid ones during conflict detection by validating each listener's spec independently before running conflict resolution.
+
+# Enhancements that improve performance.
+performance improvements: |
+
+# Deprecated features or APIs.
+deprecations: |
+
+# Other notable changes not covered by the above sections.
+Other changes: |