chore(deps): Bump the k8s.io group to v0.35.8 and sync module versions

[hrak]

Summary

Brings hack/tools and test/e2e into line with the root module on three fronts: the k8s.io/* group, the CloudStack API client, and the ginkgo/gomega test libraries.

k8s.io group → v0.35.8

Applies the bump already made in the root module to the other two, so all three resolve the same Kubernetes library versions.

The bumped set mirrors the root module exactly — api, apiextensions-apiserver, apimachinery, apiserver, client-go, component-base — all v0.35.4 → v0.35.8. k8s.io/cluster-bootstrap deliberately stays at v0.35.4 to match root, and no broad go get -u was run, so no unrelated transitive drift is pulled in.

Note that most of these are indirect requirements in the two side modules; that is unavoidable, since neither has a direct dependency on the whole group (hack/tools has no direct k8s dependency at all). Leaving them out would produce version skew inside a module — api/apimachinery at .8 against client-go at .4, since cluster-api v1.13.5 pins .4 — which go mod tidy will not reconcile.

google.golang.org/protobuf moves to the pseudo-version that k8s.io v0.35.8 itself requires, matching what the root module already carries.

cloudstack-go sync (downgrade, intentional)

Pins test/e2e to github.com/apache/cloudstack-go/v2 v2.17.1, the version the manager uses. This is a downgrade from v2.19.0, and deliberate: the CloudStack deployments we test against are old enough that the newer client is not representative, so the e2e suite should exercise the same client version as the controller. Please don't "fix" this back up in a later dependency sweep.

ginkgo / gomega sync

Brings test/e2e to ginkgo v2.28.3 and gomega v1.40.0, the versions root already uses. The Makefile derives GINGKO_VER from the root go.mod (Makefile:96), so the ginkgo runner was already built from v2.28.3 while the e2e module compiled against v2.28.1. github.com/google/pprof moves to a newer pseudo-version as a requirement of ginkgo v2.28.3.

Security note

This PR does not change the Dependabot picture. All 19 open alerts are transitive, across golang.org/x/crypto, go.opentelemetry.io/otel, otel/sdk, google.golang.org/grpc and golang.org/x/net, and every one is already remediated on develop by the CAPI v1.13.5 upgrade (#123). They are reported against the default branch main, so they will not close until develop reaches main.

Test plan

• go build ./... && go vet ./... clean on the root module
• go vet -tags e2e ./... clean on test/e2e — confirms neither the cloudstack-go downgrade nor the ginkgo/gomega bump touches API surface the suite uses
• Both hack/tools mdbook binaries build
• make test — Webhook Suite 28/28, Cloud Suite 127/127, all internal/controllers integration tests pass
• make run-e2e needs a live CloudStack environment — not run here

🤖 Generated with Claude Code