Add OpenStackAssistant CRD with MCP server support

[dprince]

Introduces a new OpenStackAssistant custom resource
(assistant.openstack.org/v1beta1) that deploys a managed Goose AI agent
pod for cluster diagnostics via Lightspeed Stack.

OpenStackAssistant CRD and controller:
- New CRD with spec fields for provider type, container image,
  Lightspeed Stack backend configuration, node selectors, and
  additional environment variables
- GooseConfig supports model selection, recipe ConfigMaps (registered
  as Goose slash commands), hints ConfigMaps (written to .goosehints),
  and MCP server references
- Controller creates a ServiceAccount, ClusterRole with read-only RBAC
  for cluster diagnostics, ClusterRoleBinding, ConfigMap with Goose
  configuration and entrypoint script, and the assistant Pod
- Watches referenced Secrets and ConfigMaps; reconciles on changes and
  tracks input hashes to detect drift
- Defaulting webhook sets the container image from an environment
  variable fallback
- Condition-based status reporting (ServiceAccount, RBAC, ConfigMap,
  Pod readiness)

MCP server sidecar support for OpenStackClient:
- New MCPConfig struct (enabled flag, containerImage) on the
  OpenStackClient CR spec
- When enabled, the OpenStackClient controller adds a rhos-mcps MCP
  server sidecar container sharing the same clouds.yaml/secure.yaml
  credential mounts
- Controller creates a ConfigMap with rhos-mcps config (openstack
  enabled, openshift disabled, allow_write: false) and a Service on
  port 8080 for the MCP endpoint
- OpenStackAssistant can reference an OpenStackClient CR by name via
  the openstackClientRef field; the controller auto-computes the
  service URL and TLS CA configuration

Tests:
- Unit tests for the OpenStackAssistant controller covering
  reconciliation, pod creation, config generation, and status
  conditions
- Unit tests for helper functions (entrypoint script generation,
  config building, hash computation)