authentik: spell out API-defaulted fields on the LDAP route and listeners

The API server defaults group on allowedRoutes.kinds and certificateRefs,
and group, kind and weight on the TCPRoute backendRefs. Omitting them left
both ArgoCD apps permanently OutOfSync against the live objects. Matches
what authentik-httproute.yaml already does.

applications/authentik/ldap/tcproute.yaml

@@ -20,3 +20,6 @@ spec:
     - backendRefs:
         - name: authentik-ldap
           port: 3389
+          kind: Service
+          group: ""
+          weight: 1

infra/envoy-gateway/authentik/authentik-ldap-gateway-patch.yaml

@@ -8,7 +8,8 @@
     port: 389
     allowedRoutes:
       kinds:
-        - kind: TCPRoute
+        - group: gateway.networking.k8s.io
+          kind: TCPRoute
       namespaces:
         from: Selector
         selector:
@@ -24,12 +25,14 @@
     tls:
       mode: Terminate
       certificateRefs:
-        - kind: Secret
+        - group: ""
+          kind: Secret
           name: authentik-ldap-tls
           namespace: envoy-gateway
     allowedRoutes:
       kinds:
-        - kind: TCPRoute
+        - group: gateway.networking.k8s.io
+          kind: TCPRoute
       namespaces:
         from: Selector
         selector: