Managed security group API server rule ignores configured apiServerPort

/kind bug

**What steps did you take and what happened:**

Create an `OpenStackCluster` with:
- `apiServerPort` set to a non-default value (for example `8443`)
- `apiServerLoadBalancer.enabled: true`

After the cluster reconciles, the Octavia load balancer listener and pool member are both created on the configured port (`8443` in this example). The managed security group's "Kubernetes API" ingress rule is still created on port `6443`, regardless of `apiServerPort`.

Confirmed against a live cluster with `openstack security group rule list`:

IP Protocol: tcp
Port Range: 6443:6443
Direction: ingress
IP Range: 0.0.0.0/0

And `openstack loadbalancer listener list` / `openstack loadbalancer member list` for the same cluster:

name: k8s-clusterapi-cluster---kubeapi-8443
protocol_port: 8443

So the load balancer is reachable on `8443`, but the security group only opens `6443` — the port nothing is actually listening on. Traffic to the real API server port is not allowed by the managed security group at all.

Reproduced on `v0.14.6` and `v0.15.0-rc.0` separately using `spec.apiServer.port`. Same result on both: the security group rule is unaffected by the configured port.

**What did you expect to happen:**

The managed security group's API server ingress rule should open the configured `apiServerPort` (or `spec.apiServer.port` on `v1beta2`), not a hardcoded `6443`.

**Anything else you would like to add:**

The rule is built in `getSGControlPlaneHTTPS()` in `pkg/cloud/services/networking/securitygroups_rules.go`, which hardcodes `PortRangeMin`/`PortRangeMax` to `6443`.

Separately, and lower priority: the `apiServerPort`/`apiServer.port` field description ("the port on which the listener on the APIServer will be created") reads as listener-only. In practice this same value also sets the Octavia pool member's port and `ControlPlaneEndpoint.Port`, which might make documentation misleading.

**Environment:**

- Cluster API Provider OpenStack version (Or `git rev-parse HEAD` if manually built): v0.14.6, also reproduced on commit dd4999d3 (v0.15.0-rc.0)
- Cluster-API version: v1.13.4
- OpenStack version: Yoga
- Minikube/KIND version: N/A (management cluster is RKE2)
- Kubernetes version (use `kubectl version`): v1.35.7+rke2r1
- OS (e.g. from `/etc/os-release`): N/A

Start in pkg/cloud/services/networking/securitygroups_rules.go at getSGControlPlaneHTTPS() and trace how the configured API server port is available to the security group rule. Verify the managed rule uses that configured port rather than a fixed value, then confirm it matches the Octavia listener and pool member port described in the issue.

Written by the indexing model from the issue text.