[addon-operator] chore(deps): update k8s.io dependencies to v0.35.8

[Glitchy-Sheep]

Overview

Bump k8s.io libraries to v0.35.8 for the Kubernetes 1.37 cycle.

What this PR does / why we need it

The platform is moving to Kubernetes 1.37, and the default version becomes 1.35. Runtime keeps its libraries in step with the default version.

• k8s.io/*: v0.34.8 -> v0.35.8
• sigs.k8s.io/controller-runtime: v0.22.5 -> v0.23.3
• helm.sh/helm/v3: v3.19.5 -> v3.20.2 (first line that pins k8s 0.35)
• Dockerfile ARG kubectlVersion: v1.34.8 -> v1.35.8

Draft: pins point at commits, not tags

Three dependencies are pinned to commits from their open PRs, because their tags are not cut yet:

• github.com/flant/kube-client -> [kube-client]: bump k8s.io libraries to v0.35.8 kube-client#46
• github.com/deckhouse/module-sdk -> [module-sdk] chore: bump k8s to 0.35.8 deckhouse/module-sdk#134
• github.com/flant/shell-operator -> [shell-operator] chore(deps): update k8s.io dependencies to v0.35.8 shell-operator#929

All three need to be replaced with real tags before this leaves draft.

The docker/cli replace stays, its comment did not

replace github.com/docker/cli => v28.2.2 is still needed, but for a different reason than the comment said. It named helm.sh/helm/v3 v3.15.x as the consumer of oras.land/oras-go v1.2.6. helm 3.20.2 no longer pulls oras-go v1 at all - github.com/werf/nelm does. The pin is unchanged, only the comment now points at the real source.

Special notes for your reviewer

make test and make lint are clean, go mod tidy is idempotent.

Reminder for the merge: this repo needs the skip/image/latest label, otherwise publish-release.yaml fires on PR close and rebuilds latest for three platforms.

Does this PR introduce a user-facing change?

NONE