feat(telco-kpis): Implement unified lockdowns role with hub capture and parse

[ccardenosa]

Implements a unified lockdowns role for hub/spoke operator lockdown management,
enabling repeatable OpenShift cluster deployments with locked operator versions.

Key Features:

1. Unified Role Structure (lockdowns)
   - Mode-based dispatcher (hub/spoke) with action (parse/capture)
   - Common utilities: download, validation, symlink generation
   - Separate task files for hub and spoke operations
   - Jinja2 templates for lockdown JSON generation

2. Hub Lockdown Capture
   - Queries cluster for OCP version, Subscriptions, OperatorGroups, CatalogSources
   - Detects architecture via skopeo (x86_64/arm64, multi-arch support)
   - Maps mirrored catalog names to upstream (cs-redhat-operator-index-* → redhat-operators)
   - Enriches FBC operators with mirroring metadata:
     * fbc_iib_repo: 'latest'
     * ocp_operator_mirror_fbc_image_base: quay.io/redhat-user-workloads/telco-5g-tenant/{catalog}-{version}
   - Generates dual-format OCP pull specs (digest + tag)
   - Outputs timestamped lockdown JSON with cluster metadata

3. Hub Lockdown Parse
   - Downloads lockdown JSON from URI (GitLab, Gitea, file://)
   - GitLab symlink resolver handles multi-hop symlink chains:
     * lockdown-hub-x86_64.json → lockdown-hub-4.21-x86_64.json → ../4.21/actual.json
     * Detects JSON vs symlink text, resolves relative paths
     * Max 5 hops protection
   - Uses slurp module (not lookup) for SSH compatibility (Ansible controller vs remote host)
   - Validates lockdown structure (required fields, nested hierarchy)
   - Transforms operators for upstream compatibility:
     * Adds 'nsname' field from 'namespace' (upstream role requirement)
   - Sets facts: hub_lockdown_operators, hub_ocp_pull_spec, hub_ocp_version

4. Telco-KPIs Wrapper Playbook (deploy-ocp-operators.yml)
   - Three-phase workflow:
     * Phase 1: Parse lockdown (if hub_lockdown_uri provided) OR use parameters
     * Phase 2: Call upstream deploy-ocp-operators.yml with transformed operators
     * Phase 3: Capture lockdown (if generate_hub_lockdown requested)
   - Integrates with Jenkins install-hub-operators job
   - Supports both lockdown mode and parameter mode

5. Lockdown JSON Format
   - Nested structure: {hub: {ocp: {...}, operators: [...], metadata: {...}}}
   - OCP pull_spec with both digest (immutable) and tag (human-readable)
   - Operators include: name, namespace, catalog, channel, subscription_name,
     installed_csv, install_plan_approval, og_name, og_spec
   - FBC operators include additional: fbc_iib_repo, ocp_operator_mirror_fbc_image_base
   - Metadata: cluster_name, capture_timestamp (ISO8601)

[ccardenosa]

/test images

[openshift-ci]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign mrniranjan for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment