Add FIPS support with Go native crypto and unique operator labels

[JasonPowr]

Summary

• Switch the admission-webhook-controller binary from OpenSSL-based FIPS (CGO_ENABLED=1, GOEXPERIMENT=strictfipsruntime) to Go 1.24+ native FIPS (GOFIPS140=v1.0.0, CGO_ENABLED=0, -tags no_openssl), and set GODEBUG=fips140=only on FIPS-enabled clusters at runtime
• Replace the default Operator SDK control-plane: controller-manager label with control-plane: policy-controller-operator across all manifests to prevent webhook/metrics routing collisions with other operators in the same namespace
• Add a dedicated FIPS e2e test suite (test/e2e_fips/) that verifies kernel FIPS mode, GODEBUG env propagation, and the GOFIPS140 build marker in running binaries
• Integrate FIPS detection into the existing e2e and upgrade suites so they automatically configure GODEBUG=fips140=only when running on FIPS clusters
• Mark the operator bundle as fips-compliant: "true" and enable the fips-check Tekton parameter in CI pipelines
• Fix flaky e2e test failure cause

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 18.33%. Comparing base (d3c42ca) to head (9c36079).

Additional details and impacted files

@@           Coverage Diff           @@
##             main     #317   +/-   ##
=======================================
  Coverage   18.33%   18.33%           
=======================================
  Files           3        3           
  Lines          60       60           
=======================================
  Hits           11       11           
  Misses         49       49           

Flag	Coverage Δ
unit	18.33% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[JasonPowr]

/retest