chore(deps): upgrade haproxy to 2.9.7-alpine - Closes [#18159]

[avo-sepp]

HAProxy was last updated June 14, 2023 to 2.6.14. That release now has two CVEs which are being flagged by Wiz scanner as High vulnerability.

2.6.14 CVE Listings

• CVE-2023-40225
• CVE-2023-45539

Checklist:

• Either (a) I've created an enhancement proposal and discussed it with the community, (b) this is a bug fix, or (c) this does not need to be in the release notes.
• The title of the PR states what changed and the related issues number (used for the release note).
• The title of the PR conforms to the Toolchain Guide
• I've included "Closes [ISSUE #]" or "Fixes [ISSUE #]" in the description to automatically close the associated issue.
• I've updated both the CLI and UI to expose my feature, or I plan to submit a second PR with them.
• Does this PR require documentation updates?
• I've updated documentation as required by this PR.
• I have signed off all my commits as required by DCO
• I have written unit and/or e2e tests for my change. PRs without these are unlikely to be merged.
• My build is green (troubleshooting builds).
• My new feature complies with the feature status guidelines.
• I have added a brief description of why this PR is necessary and/or what this PR solves.
• Optional. My organization is added to USERS.md.
• Optional. For bug fixes, I've indicated what older releases this fix should be cherry-picked into (this may or may not happen depending on risk/complexity).

[crenshaw-dev]

Thanks, @avo-sepp! Can you fix the DCO check?

[avo-sepp]

Updated for the DCO Check. Do you have any comment on using a minor release instead of specifying a patch release? 2.9 vs 2.9.7? So we can get CVE fixes as they come up?

Specifically 2.9-alpine, which nets us auto patch upgrades? Or do we hold 2.9.7-alpine?

[crenshaw-dev]

I would only ever deploy pinned versions personally. tbh I'd love to specify the SHA to make it even more reliable. I think the overhead of bumping tags is worth it for the predictability.

[avo-sepp]

Been running about a day in production here with all of our workloads. I have not noted any CPU or memory spikes. Any strange logs from the application or repo servers. I'm confident this can be tested by a larger audience for confirmation now.

[avo-sepp]

Reporting in after one week in use. No issues noted. Argo functioning as expected.