renovate: annotate Makefile tool versions

[vdaviot]

Summary

Annotates the kubebuilder-scaffolded tool pins in Makefile so the new shared platform-renovate preset's customManagers:makefileVersions can manage them. Tracks one of the four follow-ups listed in scality/platform-renovate#3 (the in-flight PR comment).

Annotations added

• OPERATOR_SDK_VERSION → operator-framework/operator-sdk GitHub releases
• CERT_MANAGER_VERSION → cert-manager/cert-manager GitHub releases
• KUSTOMIZE_VERSION → kubernetes-sigs/kustomize GitHub releases. Uses extractVersion=^kustomize/(?<version>.*)$ because the upstream releases are tagged with a kustomize/ prefix (the kustomize repo is a multi-tool monorepo).
• CONTROLLER_TOOLS_VERSION → kubernetes-sigs/controller-tools GitHub releases
• GOLANGCI_LINT_VERSION → golangci/golangci-lint GitHub releases

Refactor: opm URL → OPM_VERSION

The previous opm rule had v1.55.0 hardcoded inside a curl URL, which Renovate's regex managers can't see. Refactored to a tracked variable:

# renovate: datasource=github-releases depName=operator-framework/operator-registry
OPM_VERSION ?= v1.55.0
...
curl -sSLo $(OPM) https://github.com/operator-framework/operator-registry/releases/download/$(OPM_VERSION)/$${OS}-$${ARCH}-opm

The downloaded URL is identical at runtime; only the source-of-truth changes.

Merge order

Depends on scality/platform-renovate#3 (and indirectly on scality/crl-operator#15 which wires this repo to the shared preset). The annotations are inert until the new preset's customManagers:makefileVersions is active.

Test plan

• make opm (or any rule that exercises OPM) still downloads the same v1.55.0 binary.
• After the prerequisites land, observe the 6 tool pins under the operator-tooling / golangci-lint groups on the Dependency Dashboard.