[hotfix][ci] Replace disallowed azure/setup-helm action with a direct Helm download

[Dennis-Mircea]

What is the purpose of the change

The Helm Lint Test CI job used the azure/setup-helm action, which is no longer on the ASF INFRA GitHub Actions allowlist. GitHub rejects disallowed actions at workflow startup, so the whole "Flink Kubernetes Operator CI" workflow fails with startup_failure and no jobs run. This blocks CI on every PR.

This change installs Helm with a plain curl step instead, so no third-party action is needed.

Brief change log

• Replace the azure/setup-helm@<sha> step in ci.yml with a bash step that downloads Helm from the official get.helm.sh host, verifies its SHA-256 checksum, and installs it to /usr/local/bin.
• Keep the same pinned version (v3.17.3) and follow the existing chart-testing step style (download and extract under /tmp).

Verifying this change

This change is CI-only. It is verified by the workflow starting successfully and the Helm Lint Test job running Helm unittest and chart-testing lint as before.

Does this pull request potentially affect one of the following parts:

• Dependencies (does it add or upgrade a dependency): no
• The public API, i.e., is any changes to the CustomResourceDescriptors: no
• Core observer or reconciler logic that is regularly executed: no

Documentation

• Does this pull request introduce a new feature? no
• If yes, how is the feature documented? not applicable