FR: Additional configuration for k8s-operator spawned pods

### What are you trying to do?

the k8s-operator creates a new `Statefulset` per exposed service - the operator allows configuration of some parameters via env var; e.g `PROXY_IMAGE` - however there are only a limited subset of configurable options. So far, I've had to handle these in a mutating webhook:

- tolerations
- node affinity
- requests/limits
- env vars; e.g `TS_EXTRA_ARGS` (need to add `--netfilter-mode=off` to avoid tailscale blackholing routes)
- container `postStart` lifecycle hook (for `iptables` related to the above netfilter argument)

This is not an exhaustive list of pod spec/statefulset spec that should be exposed and configurable

### How should we solve this?

Support for this can be added by exposing additional env vars (this can get out of hand pretty quickly), providing the operator a statefulset template in a configmap it then patches, or provide a json patch in a configmap the operator applies to the statefulset spec it generates

### What is the impact of not solving this?

Without a solve for this, end users will either have to deploy statefulsets manually (which largely defeats the utility of the operator) or use mutating webhooks

### Anything else?

_No response_