fix(cachebust): prevent shell injection in purge paths

[petrsimon]

Summary

• Paths supplied via akamaiCacheBustPaths were previously interpolated directly into a shell command string, allowing a malicious path value to execute arbitrary shell code in the cache-bust Job container.
• Paths are now passed as separate Container.Args entries via bash "$@", so no shell interpolation occurs.
• A IsValidCacheBustPath validator (allowlist regex) filters any path that contains shell metacharacters at reconcile time, with a log warning per invalid entry.
• CRD field gains a +kubebuilder:validation pattern annotation so the API server can reject obviously malformed values at admission.
• New unit test file controllers/reconcile_cachebust_test.go (276 lines) covers normal paths, full URLs, deduplication, rejection of shell metacharacters, and edge cases.

Test plan

• make test — unit tests pass including new TestCreateCachePurgePathList cases
• make lint — no new lint errors
• make generate && make manifests — CRD YAML updated for pattern annotation
• E2E kuttl: cachebust and cachebust-multiple-urls assert files updated to match new container command/args shape
• Manual: deploy with a crafted path containing $(...) — operator logs skip message, path absent from Job args

---