Sync CRDs with operator (k8s 1.36 type bump + embedded ObjectMeta fix)

[sky333999]

Description

Syncs the four cloudwatch.aws.amazon.com CRDs with the operator repo, picking up:

1. k8s 1.36 type bump (operator PR Bump prometheus/prometheus to v0.312.0 and cascading dependencies aws/amazon-cloudwatch-agent-operator#395): additive schema for new upstream fields — env[].fileKeyRef, containers[].restartPolicyRules, and the podCertificate projected volume source — plus regenerated descriptions and consolidated ordering. These match what the upstream OpenTelemetry Operator collector CRD already ships.
2. Embedded ObjectMeta fix (operator PR Regenerate CRDs with generateEmbeddedObjectMeta flag aws/amazon-cloudwatch-agent-operator#402): #395's CRDs were regenerated without crd:generateEmbeddedObjectMeta=true, stripping the name/labels/annotations schema from PVC template metadata. This sync includes the corrected CRDs — do not merge before #402.

Files are byte-identical copies from the operator repo's config/crd/bases/ (the chart's crds/ files are static, not templated).

Verification

• helm template --include-crds rendered before/after: document set unchanged (34 docs); the only semantic delta is the 4 CRDs, which match the operator repo exactly. (Cert-bearing Secrets/webhook configs differ on every render by design.)
• Fresh install on a dev EKS cluster (1.32): all workloads healthy; CRs with volumeClaimTemplates[].metadata labels/annotations are accepted and propagated to the StatefulSet PVC template.
• Negative test: applying #395's un-fixed CRD to the same cluster makes such CRs fail admission with strict-decoding 'unknown field' errors — confirming why the #402 fix is included in this sync.