Expose alb.ingress.kubernetes.io/ssl-policy as a configurable value

charts/registry/templates/ingress.yaml hardcodes several ALB annotations (listen-ports, ssl-redirect, target-type, etc.) and exposes inboundCidrs as a values-driven extensibility point, but there's no way to set alb.ingress.kubernetes.io/ssl-policy. Without it, the AWS Load Balancer Controller falls back to its own legacy default (ELBSecurityPolicy-2016-08), which can cause TLS handshake failures with some client-side security proxies/brokers expecting a more modern policy (e.g. ELBSecurityPolicy-TLS-1-2-Ext-2018-06).

Workaround: manually annotate the live Ingress object outside of Helm.

Suggested fix: add an optional global.ingress.sslPolicy value, following the same pattern as inboundCidrs.