feat(t8s-cluster/management-cluster): validate new k8s version before upgrade

[cwrau]

Currently the user can (accidentally) downgrade the k8s version, which is of course not supported

This job checks the new version against the running version and fails it is lower

[teutonet-bot]

🤖 I have diffed this beep boop

"/$namespace/$kind/$name.yaml" for normal resources
"/$namespace/HelmRelease/$name/$namespace/$kind/$name.yaml" for HelmReleases <- this is recursive
'null' means it's either cluster-scoped or it's in the default namespace for the HelmRelease

charts/t8s-cluster/ci/artifacthub-values.yaml

charts/t8s-cluster/ci/cidrs-values.yaml

charts/t8s-cluster/ci/injectedCertificateAuthorities-values.yaml

charts/t8s-cluster/ci/securityGroups-values.yaml

charts/t8s-cluster/ci/calico-values.yaml has no changes

charts/t8s-cluster/ci/bastion-values.yaml

charts/t8s-cluster/values.yaml