ECI-1504: Support OC2 (US Gov) and OC3 (US DoD) realms in OCI integration

[EamonBrady1]

What

Adds support for OCI US Government (OC2) and US Department of Defense (OC3) realms across the OCI Datadog integration: the docker-images.sh build/push script, the datadog-terraform-onboarding stack, and the datadog-integration Resource Manager stack.

The realm is auto-detected from the tenancy OCID prefix (ocid1.tenancy.oc2. → OC2, ocid1.tenancy.oc3. → OC3, otherwise OC1 commercial). Each realm uses a different OCIR registry host format and a different Datadog-published image namespace (OCIR is realm-isolated):

Realm	Registry host	Image namespace
OC1 commercial	<region-key>.ocir.io	iddfxd5j9l2o
OC2 US Gov	ocir.<region>.oci.oraclegovcloud.com	axnu2nwmcbsr
OC3 US DoD	ocir.<region>.oci.oraclegovcloud.com	ax8ew96ycvtn

Specifics:

• datadog-functions/docker-images.sh: realm-aware registry host detection (gov/dod use the full region identifier, not the 3-letter key); fetches both region-name and region-key from oci iam region-subscription list; prints the computed host per region for verification.
• datadog-terraform-onboarding: added 5 provider aliases + module blocks for us-langley-1, us-luke-1 (OC2) and us-gov-ashburn-1, us-gov-chicago-1, us-gov-phoenix-1 (OC3). The regional-stacks module now takes image_namespace and image_realm variables (defaulting to commercial values, so existing commercial blocks are unchanged). docker_image_check.sh is realm-aware so gov/dod regions aren't falsely marked unsupported.
• datadog-integration: same realm detection + realm-aware docker_image_check.sh; create_apply_regional_stack.sh accepts and forwards image_namespace/image_realm into the regional stack VARIABLES_JSON; the regional-stacks module gets the same two new variables.
• datadog-functions/README.md: documented how to run docker-images.sh including realm support and gov/dod notes.
• Vault quota precheck is skipped for OC2/OC3 realms: the virtual-vault-count limit is not exposed in the OCI limits API for gov/dod realms (even though DEFAULT vaults are supported and creatable), so the check would fail with "Invalid parameter". The skip is realm-based (not per-region) so new gov/dod regions work without code changes.
• Bumped Dockerfile Go base image from golang:1.25.9 to golang:1.26 to match go.mod requirement (go 1.26.0).

Why

Gov/DoD tenancies could not use the integration: the registry host was hardcoded to the commercial <region-key>.ocir.io pattern and the image namespace was hardcoded to the commercial iddfxd5j9l2o, neither of which is reachable from a Gov/DoD realm. OCIR is realm-isolated, so each realm needs its own host format and Datadog-published namespace.

Testing

• terraform validate → Success! for both datadog-terraform-onboarding and datadog-integration (after terraform init -backend=false).
• terraform fmt -check -recursive → clean for both modules.
• bash -n syntax check on all four shell scripts (docker-images.sh, both docker_image_check.sh, create_apply_regional_stack.sh) → OK.
• docker_image_check.sh exercised with mock stdin for OC1 (us-ashburn-1/IAD), OC2 (us-langley-1/LFI), and OC3 (us-gov-chicago-1/PIA): commercial returns success, gov/dod build the correct ocir.<region>.oci.oraclegovcloud.com host (returns "failed-to-get" only because the gov endpoint is unreachable from a commercial network — host construction verified correct). Defaults (no namespace/realm) preserve prior commercial behavior.
• docker-images.sh realm detection verified with mock region-subscription list JSON: us-langley-1 → ocir.us-langley-1.oci.oraclegovcloud.com, us-gov-ashburn-1 → ocir.us-gov-ashburn-1.oci.oraclegovcloud.com, commercial unchanged.
• Commercial backward compatibility: new variables default to oc1/iddfxd5j9l2o, and the 5 new gov/dod provider aliases / module blocks are gated by contains(local.final_regions_for_stacks, ...), so they stay count=0 on commercial tenancies.
• Images successfully built and pushed to OC3 (US DoD) registries end-to-end using the updated docker-images.sh.

[github-actions]

Version bumped: 1.2.4 → 1.2.5 (patch auto-bump)

Override if needed:

• Breaking change → manually set VERSION and datadog-terraform-onboarding/VERSION to bump the major digit.
• New feature → manually bump the minor digit.
• Minor bug fix → no change needed; the patch bump above is correct.

[github-actions]

Version bumped: 1.2.5 → 1.2.6 (patch auto-bump)

Override if needed:

• Breaking change → manually set VERSION and datadog-terraform-onboarding/VERSION to bump the major digit.
• New feature → manually bump the minor digit.
• Minor bug fix → no change needed; the patch bump above is correct.