feat: set default CoreDNS version

[dkoshkin]

What problem does this PR solve?:
Automatically upgrades the CoreDNS version. This is done by always setting dns.imageTag in KCP in the CoreDNS handler, based on the mapping to the cluster's Kubernetes version.

This component is different from etcd and kube-proxy that is also installed by kubeadm for a few different reasons.

• an etcd upgrade is handled by kubeadm
• kube-proxy, another "addon", is upgraded by CAPI core because its version will match the Kubernetes version

This functiona call is misleading and will only update the version if its set in KCP.

To not cause a rollout of all managed clusters by changing the defaults, this PR introduces a new API to opt in. To enable this functionality a client can set this new API like so for new clusters and during cluster upgrades:

spec:
  topology:
    variables:
      - name: clusterConfig
        value:
          dns:
            coreDNS: {}

Which issue(s) this PR fixes:
Fixes #

How Has This Been Tested?:

Special notes for your reviewer:

[dkoshkin]

🤔 this would actually cause a rollout of new CP machines for all workload clusters after CAREN is updated. Maybe we should do this in a mutating webhook and set the version on the Cluster object?
A webhook won't really work either, we can't tell the difference between a default value and a user set value on an upgrade. Maybe some additional API to enable this functionality?

[jimmidyson]

@dkoshkin I hope you don't mind but I pushed 07c7ebe which I think is a bit more readable but retains same logic (unchanged and passing tests).

[dkoshkin]

@jimmidyson I would like your help on the CEL validation, I couldn't find any examples can you point me to some in the repo?

[dkoshkin]

@jimmidyson I was thinking about this some more. Do we even need/want a new API type to define the upgrade strategy? (In that case I would revert the last commit and change the handler to return if dnsVar is empty)
What if having coreDNS: {} enables the auto update logic. This is similar to the addon lifecycle hooks that don't have any "enabled" API, the struct not being nil enables it.

Made the change in 6541992

[jimmidyson]

Great work!