test(functional): add k8sfunctional and functional suites with kind CI

[TerryHowe]

What

The functional test suites for v3, extracted from #1130. Combines what were
previously two PRs — #1284 has been folded in here and closed, since it was a
strict superset of this branch and splitting them only meant rebasing the same
files twice.

Two suites, each behind its own build tag so neither runs during go test ./...:

• k8sfunctional — the integration suite, run against a registry deployed
  on a kind cluster in CI.
• functional — config, mirror, policy and signature coverage, run against
  registries brought up by setup.sh.

The tags are mutually exclusive: each suite defines its own TestMain, so
go vet -tags 'functional k8sfunctional' reports multiple definitions. Vet or
test one tag at a time.

Base

Rebased onto main. #1328 has merged, so the two ClientBuilder commits that
used to sit at the base of this branch have dropped out — the diff is now
test/functional/ and .github/workflows/functional.yml only, and both suites
build against main as it stands (go vet and go test -c clean under each
tag).

One behavioural fix worth a look

TestSignature_GPG_WrongKeyRejected signs with key A and verifies against
key B, and asserted that IsImageAllowed returned a nil error. That was
correct until #1316, which deliberately changed the contract:

Verify discarded every per-signature rejection and returned (false, nil),
which made a misconfigured keyring indistinguishable from unsigned content.
Collect the reasons and return them when nothing validates. Genuinely
unsigned content still returns (false, nil).

So a signature that is present but validates against no configured key now
rejects with a reason, while genuinely unsigned content rejects with a nil
error. The test asserted the old half of that contract and has been red since
#1316 merged. It now asserts the current one: the image must be rejected, and
the rejection must carry a reason. The unsigned half stays covered by
TestSignature_GPG_UnsignedImageRejected, which expects a nil error.

Both paths deny the image, so this was never a policy bypass — only a stale
expectation in the test.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 85.20%. Comparing base (4329def) to head (4952800).

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #1283      +/-   ##
==========================================
+ Coverage   85.17%   85.20%   +0.02%     
==========================================
  Files          94       94              
  Lines        7333     7333              
==========================================
+ Hits         6246     6248       +2     
+ Misses        664      662       -2     
  Partials      423      423              

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.