feat: support managed endpoint direct push in config-reloader

[nandajavarma]

What

Updates the runner VM's Prometheus config-reloader (update-prometheus-config.sh) to support the new managedEndpointUrl and managedBearerToken fields in the PrometheusConfig JSON stored in Secret Manager.

Why

Part of the telemetry ingest token work (design doc). The GCP runner now mints scoped JWTs and writes them to the PrometheusConfig secret. The config-reloader needs to read these fields and render a remote_write target with Bearer auth pointing directly at the management plane's /telemetry/metrics/v1 endpoint.

This bypasses the local RemoteWriteReceiver → ReportRunnerMetrics RPC path, reducing latency and removing a hop.

How

• Parse managedEndpointUrl and managedBearerToken from the Secret Manager JSON
• When both are present, render a remote_write target with authorization.type: Bearer and authorization.credentials
• Fall back to localRemoteWriteUrl when managed endpoint fields are absent (backward compatible)
• Refactor allowlist regex construction into a shared append_allowlist_relabel helper to avoid duplication between managed and local targets

Related PRs

• gitpod-io/gitpod-next#22088 — backend auth (merged)
• gitpod-io/gitpod-next#22089 — proto + handler (merged)
• gitpod-io/gitpod-next#22114 — EC2 runner (draft)
• gitpod-io/gitpod-next#22116 — GCP runner (draft, stacked on #22114)

[nandajavarma]

The runner-side PR (gitpod-io/gitpod-next#22116) now gates the TelemetryTokenSource wiring on a MANAGED_METRICS_DIRECT_PUSH=true env var. This makes the runner code backward-compatible — without the env var, it falls back to the local RemoteWriteReceiver path.

This PR needs to set that env var on the runner container so the direct-push path activates once the Terraform module is applied. Add it to the docker run command for gitpod-runner:

         --env GITPOD_DEVELOPMENT_VERSION=${DEVELOPMENT_VERSION} \
+        --env MANAGED_METRICS_DIRECT_PUSH=true \
         --env no_proxy=${NO_PROXY} \

This ensures the rollout order is safe:

1. Runner code lands first (env var unset → old path)
2. Terraform module applied (sets env var + updates config-reloader → new path)