refactor: apply best practices across controller, tests, CI, and Helm chart

[dntosas]

Replace global mutable state with an injected Config struct, eliminating
data races in parallel tests and improving testability. Introduce sentinel
errors (ErrWrongSecretType, ErrWrongSecretKey, ErrInvalidKubeConfig) for
programmatic error handling with errors.Is().

Reconciler improvements:

• Fix potential panic on empty secretList by extracting deleteArgoSecretByLabels helper
• Add watch predicates to filter only *-kubeconfig secrets, reducing reconciliation load
• Handle missing CAPI CRDs gracefully with apimeta.IsNoMatchError
• Use passed ctx consistently instead of context.Background()
• Replace switch/case bool with idiomatic if/else
• Fix sync-duration flag description typo
• Add custom Prometheus metrics (created/updated/deleted counters)

Testing:

• Remove deprecated Ginkgo v1 / Gomega, replace with TestMain + envtest
• Fix data races by passing Config as parameter instead of mutating globals
• Use errors.Is() assertions instead of string comparison
• Add tests for sentinel errors and ValidateCapiNaming
• Rename constructs_test.go to testhelpers_test.go

CI/CD:

• Enable golangci-lint in CI workflow
• Add pull_request trigger to CI and CodeQL workflows
• Add weekly schedule to CodeQL for continuous security scanning
• Update Go image to 1.24 and golangci-lint to v2.1.6

Helm chart:

• Add PodDisruptionBudget template
• Add NetworkPolicy template with DNS/API server egress rules
• Add readOnlyRootFilesystem to container security context defaults