Support per-container image overrides (DatadogAgentGenericContainer.image)

[Shallav91]

What does this PR do?

Adds an image field (AgentImageConfig) to DatadogAgentGenericContainer, so per-container image overrides become expressible in both the v2alpha1 DatadogAgent and v1alpha1 DatadogAgentProfile CRDs (the type is shared; DDAI and CSIDriver CRDs regenerate identically).

The container-level image is applied in overrideContainer(), which PodTemplateSpec() runs after the component-level image override — so a container-level image always wins for that container.

Motivation

Fixes #3550.

Today a component-level override.nodeAgent.image is applied to every known agent container, including otel-agent, which normally runs the separate ddot-collector image (internal/controller/datadogagent/override/podtemplatespec.go). Agent images do not ship the otel-agent binary (verified on release 7.83.2: /opt/datadog-agent/embedded/bin/otel-agent absent, /etc/services.d/otel removed at build), so changing the node-agent image on a cluster with features.otelCollector.enabled: true crashloops the collector — and the CRDs offered no way to pin it back (…containers.otel-agent.image: field not declared in schema).

This blocks profiles for custom/validation agent images or phased image rollouts whenever the collector is enabled. With this change:

override:
  nodeAgent:
    image:
      name: docker.io/datadog/agent-dev:validation-tag   # all agent containers
    containers:
      otel-agent:
        image:
          name: registry.datadoghq.com/ddot-collector:7.78.1   # collector stays put

Additional Notes

• Precedence matches the existing ordering in PodTemplateSpec() (component image first, container overrides second); no behavior change for specs that don't set a container-level image.
• PullPolicy is honored per container. PullSecrets are pod-level and intentionally not applied per container (noted in the field comment).
• For cross-registry images, use the full-string form <REGISTRY>/<NAME>:<TAG> — fromImageConfig only parses the registry out of Name when the tag is embedded (pre-existing AgentImageConfig behavior, unchanged here).
• Labels/milestone: needs a maintainer to add enhancement (and milestone or qa/skip-qa) — I can't set them from a fork.

Minimum Agent Versions

• Agent: n/a (operator-only change)
• Cluster Agent: n/a

Describe your test plan

• TestContainer/override_container_image — container-level image (and pull policy) applied to the named container
• TestPodTemplateSpecContainerImageOverride — the end-to-end precedence scenario: component-level image override + container-level pin on otel-agent; asserts agent/trace-agent move to the custom image while otel-agent stays on ddot-collector
• make generate manifests run; CRDs + docs regenerated; go build ./..., go vet, and go test ./internal/controller/datadogagent/... ./api/... ./pkg/images/... green
• Can additionally validate on a live cluster (single-node profile with a custom agent image + otelCollector enabled) on request

Checklist

• PR has at least one valid label: bug, enhancement, refactoring, documentation, tooling, and/or dependencies
• PR has a milestone or the qa/skip-qa label
• All commits are signed (see: signing commits)