feat(module): add migration disable tls annotation support

[danilrwx]

Description

Add support for enabling and disabling KubeVirt live migration TLS via a temporary annotation on ModuleConfig/virtualization.

The change introduces parsing of the virtualization.deckhouse.io/disable-tls annotation in the module hook, stores the effective value in internal module values, passes it to the rendered KubeVirt migration configuration, and propagates it to the migration configuration injected into KVVMI status.

Why do we need it, and what problem does it solve?

KubeVirt already supports live migration TLS control through DisableTLS, but the virtualization module had no way to toggle it.

For now we do not want to add a public field to ModuleConfig.spec, so the setting is exposed through a temporary annotation on ModuleConfig/virtualization. This allows turning migration TLS on and off without introducing the final API shape prematurely.

What is the expected result?

1. Add annotation virtualization.deckhouse.io/disable-tls: "true" to ModuleConfig/virtualization.
2. Ensure the rendered KubeVirt migration configuration contains disableTLS: true.
3. Start a VM live migration and verify the resulting KVVMI migration configuration reflects DisableTLS=true.
4. Change the annotation to "false" or remove it and verify the default behavior is restored.

Checklist

• The code is covered by unit tests.
• e2e tests passed.
• Documentation updated according to the changes.
• Changes were tested in the Kubernetes cluster manually.

Changelog entries

section: module
type: feature
summary: Add temporary ModuleConfig annotation to control KubeVirt live migration DisableTLS setting.
impact_level: low