Consolidate Fleet's git client implementations to go-git

[thardeck]

Fleet uses different git implementations depending on the operation:

• internal/cmd/cli/apply/ (resolve current commit SHA): shell out to git rev-parse HEAD
• internal/cmd/cli/gitcloner/ (gitjob clone): go-git
• internal/bundlereader/ (Helm chart from helm.chart: git::https://…): go-getter, which shells out to the git binary for SSH
• pkg/git/ (ref listing, liveness): go-git

The shell-out paths have several problems. go-getter uses GIT_SSH_COMMAND for SSH clones (global process state requiring a mutex), replaces the system cert pool with any custom CA bundle (breaking connections to public CAs), does not enforce SSH known-host verification, and does not propagate InsecureSkipVerify from the GitRepo spec. The github.com/hashicorp/go-getter dependency also generates false-positive CVE reports in ArtifactHub. The git rev-parse shell-out in apply/ is a minor leftover with a TODO to migrate.

All git operations should use go-git directly so the same auth settings (CA bundle, credentials, known-hosts, InsecureSkipVerify) apply across all code paths.

After consolidating the git implementation in Fleet it should be possible to remove at least the git package from the Fleet Docker image.