fix: resolve crdUpgradeSafety reporting OneOf changes as unhandled (#2759)

OneOf schema changes (e.g. adding required-field constraints) were
falling back to the generic "unhandled" comparator, blocking legitimate
operator upgrades like Serverless Operator 1.35.0 to 1.36.0.

Pin sigs.k8s.io/crdify to latest master (bb9957dbf465) which includes
a dedicated oneOf validator.

Co-authored-by: Claude <noreply@anthropic.com>