fix(catalogd): apply TLS profile to catalog server (port 8443) (#2733)

The catalogd HTTP server (port 8443) hardcoded MinVersion: tls.VersionTLS12
and ignored cipher suite/curve configuration, making it non-compliant with
OpenShift's central TLS policy (OPRUN-4415).

The TLS profile flags (--tls-profile, --tls-custom-ciphers, etc.) were already
parsed and applied to the webhook and metrics servers, but the catalog server's
CatalogServerConfig had no field to receive them, and the server did not disable
HTTP/2 (unlike the webhook and metrics servers, which set NextProtos=["http/1.1"]
to mitigate GHSA-qppj-fm5r-hxr3 and GHSA-4374-p667-p6c8).

Add a TLSOpts field to CatalogServerConfig and apply all TLS settings exclusively
via those functions, keeping TLS policy out of serverutil entirely. This includes
GetCertificate (previously hardcoded from the certwatcher), so the cw parameter
is removed from AddCatalogServerToManager. Wire both the TLS profile function and
the HTTP/2-disabling opts into the catalog server config in main — in the same
order as the webhook and metrics servers (tlsOpts then tlsProfile).

Fail fast at startup if TLSOpts do not configure any certificate source
(GetCertificate, GetConfigForClient, or Certificates), so a misconfiguration
surfaces immediately rather than allowing the server to become ready while every
TLS handshake silently fails.

Fixes: OCPBUGS-86797
Relates-to: OPRUN-4415

Signed-off-by: Todd Short <tshort@redhat.com>
Co-authored-by: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>