fix cilium kubeProxyReplacement - #336

… R2 (#4834)

## What this PR does

Bumps the `velero-plugin-for-aws` init container in
`packages/system/velero/values.yaml` from `v1.14.1` to `v1.14.4`, and
updates the pin in `tests/velero_test.yaml`.

`v1.14.1` sets `x-amz-tagging` on every `PutObject`, even when the
BackupStorageLocation configures no tags, in which case the header is
empty. Cloudflare R2 rejects that with `501 NotImplemented: Header
'x-amz-tagging' with value '' not implemented`. Velero then cannot
upload backup metadata, so every Velero backup to an R2-backed location
fails. That includes Cozystack's own `cozy-default`
BackupStorageLocation when the platform backup bucket is on R2.

Upstream fixed this in v1.14.3: velero-plugin-for-aws#309 (a backport of
#299, "Only set PutObject Tagging when tags are configured"). `v1.14.4`
is the current patch release of the 1.14 line. Its only change on top of
v1.14.3 is CVE dependency bumps (#336). v1.14.3 itself also carries #310
(SSE-C presigned URLs), #313 (no amz-checksum encapsulation when
`checksumAlgorithm=""`) and CVE/Go bumps. The plugin's compatibility
table lists `v1.14.x` for Velero `v1.18.x`, which is what the chart
ships (`velero:v1.18.1`), so this stays inside the supported pairing.

Testing done:

- `make test` in `packages/system/velero` (helm-unittest v1.1.2): 7
passed, with the existing init-container pin assertion moved to
`v1.14.4`.
- `helm template` renders `velero/velero-plugin-for-aws:v1.14.4` as
`initContainers[0]` of the `velero` Deployment.
- On a Cozystack v1.6.4 staging cluster with the backup bucket on
Cloudflare R2: before the bump, Velero backups failed on the empty
`x-amz-tagging` header. After pinning the same plugin image through a
Package values override
(`docker.io/velero/velero-plugin-for-aws:v1.14.4@sha256:c85a7fa803569e3128c33e4f5766f84ab156c8d171c9f1dd2715581d45ce98fa`),
all of our volume backup and restore drills pass. That covers CSI
snapshots with the Kopia data mover to R2, and incremental backups
confirmed.

Backwards compatibility: same plugin minor line and the same Velero
version. The init container image changes, so the `velero` Deployment
rolls once on upgrade. Users who never set `tagging` on a location now
get no tagging header at all; users who do set it get the same header as
before.

The reference stays in the existing shape (tag only, no digest), like
the current `v1.14.1` line. If you'd rather pin third-party init
containers by digest, the v1.14.4 multi-arch index digest is
`sha256:c85a7fa803569e3128c33e4f5766f84ab156c8d171c9f1dd2715581d45ce98fa`.

### Screenshots

Not a UI change.

### Downstream repositories

- [x] No downstream repository is affected by this change
- [ ] [cozystack/website](https://github.com/cozystack/website) -
follow-up:
- [ ]
[cozystack/terraform-provider-cozystack](https://github.com/cozystack/terraform-provider-cozystack)
- follow-up:
- [ ]
[cozystack/ansible-cozystack](https://github.com/cozystack/ansible-cozystack)
- follow-up:
- [ ] [cozystack/ccp](https://github.com/cozystack/ccp) - follow-up:
- [ ] [cozystack/talm](https://github.com/cozystack/talm) - follow-up:
- [ ] [cozystack/cozyhr](https://github.com/cozystack/cozyhr) -
follow-up:
- [ ] [cozystack/cozy-proxy](https://github.com/cozystack/cozy-proxy) -
follow-up:
- [ ]
[cozystack/cozystack-telemetry-server](https://github.com/cozystack/cozystack-telemetry-server)
- follow-up:
- [ ]
[cozystack/external-apps-example](https://github.com/cozystack/external-apps-example)
- follow-up:
- [ ] [cozystack/examples](https://github.com/cozystack/examples) -
follow-up:
- [ ] [cozystack/community](https://github.com/cozystack/community) -
follow-up:

Trigger map walked against the diff: a third-party image tag in a system
package values file and its test; no app schema, platform values, names
or tooling.

Fixes #4852

### Release note

```release-note
fix(velero): velero-plugin-for-aws is bumped from v1.14.1 to v1.14.4, which no longer sends an empty x-amz-tagging header, so Velero backups work against S3-compatible stores that reject it, such as Cloudflare R2.
```


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **Updates**
  * Updated the AWS backup plugin used by Velero to version 1.14.4.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->