The previous selector matched an Istio-style label that does not exist
on Cilium gateway pods, which caused default-deny ingress and blocked
access to thelounge. Use fromEntities: ingress to match Cilium's own
gateway/ingress pods, consistent with the cluster repo's webhook CNP.
Add CiliumNetworkPolicy ingress rules so thelounge only accepts traffic
from the cilium external gateway in gateway-system, and znc only from
the thelounge pod. Allow host entity on both for kubelet probes.
Switch znc service to ClusterIP and drop the external-dns annotation
since direct external IRC client access is no longer desired.
Chris Farhood