Default new installs to v3 CRD mode when the cluster supports it

[caseydavenport]

Makes a brand-new operator-managed install default to v3 CRD mode (projectcalico.org/v3 served directly by CRDs, no aggregation API server) when the cluster can support it. Existing and upgraded clusters are unaffected - if Calico v1 CRDs are already present, the install stays in API-server mode.

The default only flips on a greenfield cluster (no Calico CRDs of either kind yet) that serves MutatingAdmissionPolicy, which v3 mode relies on to default policy types (Kubernetes 1.32+). On older clusters a greenfield install stays on the API server. An admin can still opt a new install back to API-server mode by applying the v1 CRDs before creating the Installation.

This is the operator-only piece of CORE-12574. The Helm and manifest defaults, and the docs updates, are tracked separately. libcalico-go's detection is deliberately left unchanged - components only run after the operator has installed the CRDs, so the existing rule resolves correctly once one set is present.

New installs on Kubernetes 1.32+ now default to serving the projectcalico.org/v3 API directly via CRDs instead of through the aggregated API server. Existing and upgraded clusters are unaffected.