feat(charon-relay): split metrics port to ClusterIP-only Service

[apham0001]

Context

The default `charon-relay` Service exposes port 3620 (Charon `--monitoring-address`) on the public LoadBalancer alongside the P2P (3610) and HTTP (3640) ports. Metrics are only ever scraped in-cluster, so 3620 has no reason to be reachable from the public internet.

Ref: ObolNetwork/obol-infrastructure#2652

Changes

• New `metricsService.enabled` toggle in `values.yaml` (default `false` to preserve existing behaviour).
• When enabled:
  • Port 3620 is removed from the LoadBalancer Service.
  • A new ClusterIP-only Service `{release}-{i}-metrics` exposes 3620.
  • ServiceMonitor (when also enabled) selects the metrics Service via its dedicated label.
• ServiceMonitor template fix: the endpoint `port` was hardcoded to `metrics` but the Service port name is `monitoring` (from `service.ports.monitoring.name`). Now uses `{{ .Values.service.ports.monitoring.name }}` so the two stay in sync regardless of mode.
• Bump chart to `0.8.0`.

Verification

```bash

Legacy mode (default): port 3620 still on LB

helm template test charts/charon-relay --set clusterSize=1 | yq 'select(.kind == "Service")'

New mode: port 3620 off LB, separate ClusterIP Service exists

helm template test charts/charon-relay --set clusterSize=1 \
--set metricsService.enabled=true --set serviceMonitor.enabled=true \
| yq 'select(.kind == "Service" or .kind == "ServiceMonitor")'
```

Migration

Existing releases keep working unchanged. To opt-in:

```yaml
metricsService:
enabled: true
serviceMonitor:
enabled: true # if you have prometheus-operator
```

This is non-breaking. The metrics endpoint URL changes from `{lb-ip}:3620` to `{release}-{i}-metrics.{ns}.svc.cluster.local:3620` — only relevant for external scrapers, which shouldn't exist (the whole point of this change).