Show sidecar mode before external mode in App and API Protection for Kubernetes

[eliottness]

What does this PR do? What is the motivation?

Reorders the App and API Protection for Kubernetes page so that sidecar mode is presented before external mode. Sidecar mode is the default deployment mode (used when no mode is set), but the page previously documented external mode first and placed sidecar mode at the end.

Changes:

• Limitations: list the sidecar mode subsection before external mode.
• How it works: present sidecar mode (default) first, then external mode, with links to both setup sections.
• Move the Set up sidecar mode section ahead of the external mode setup, and group the architecture, benefits, and setup steps under a new Set up external mode section.

This is a reordering and light reframing for clarity. No configuration values or technical steps were changed.

Merge instructions

Merge readiness:

• Ready for merge

Additional notes

[github-actions]

Preview links (active after the build_preview check completes)

Modified Files

• https://docs-staging.datadoghq.com/eliottness/sidecar-mode/containers/kubernetes/appsec
• https://docs-staging.datadoghq.com/eliottness/sidecar-mode/security/application_security/setup/kubernetes/istio

[rtrieu]

created DOCS-14914 for an in-depth review