feat: reconcile TDE in Doris Operator

[Al-assad]

Summary

• Add shared spec.tde / status.tde support for DorisCluster and DorisDisaggregatedCluster.
• Reconcile Local, AWS KMS, and Aliyun KMS material and effective FE configuration without modifying Doris/SelectDB kernel code.
• Implement Root Key rotation, KMS credential rotation, request ID reuse protection, unknown-outcome recovery, and FE replay barrier handling.
• Add validating webhook and controller runtime gates for FE lifecycle changes.

Verification

• Focused Go tests passed:
  go test ./api/tde ./api/doris/v1 ./api/disaggregated/v1 ./pkg/tde ./pkg/controller -count=1
• go vet ./... passed.
• make manifests generate passed.
• Local Key was deployed and tested in a Kubernetes test cluster:
  • initial TDE enablement reached Active/Completed;
  • Local v1 -> v2 Root Key rotation reached WaitingForFEReplay -> SyncingConfiguration -> Completed;
  • commitJournalId=148 was recorded;
  • FE lifecycle mutation during rotation was blocked;
  • data remained readable before and after rotation and after FE Pod recreation.

The full go test ./... run was manually terminated before completion because the upstream envtest/controller test phase did not finish in the available run; focused tests and vet passed.

Cloud KMS E2E was not run because no AWS/Aliyun credentials were available in the test environment.