Add remotePullPolicy to reduce remote module download costs

[turkenf]

Description of your changes

Implements remotePullPolicy field (Always, IfNotPresent) to control when remote modules are downloaded.

Port of crossplane-contrib/provider-terraform#232 for provider-opentofu.

I have:

• Run make reviewable to ensure this PR is ready for review.

How has this code been tested

Tested with index.docker.io/turkenf/provider-opentofu:v1.0.0-16.gba423dc on a kind cluster. Applied workspace with remotePullPolicy: IfNotPresent using a remote git module with entrypoint. Verified from provider logs that the module is downloaded once on the first reconciliation and skipped on subsequent reconciliations. URL change correctly triggers a re-download.

> POD=$(kubectl get pod -n crossplane-system -l pkg.crossplane.io/revision -o jsonpath='{.items[0].metadata.name}')
  kubectl exec -n crossplane-system $POD -- ls -la /tofu/
total 28
drwxr-xr-x    1 2000     root          4096 Feb 19 19:57 .
drwxr-xr-x    1 root     root          4096 Feb 19 19:34 ..
drwx------    6 2000     2000          4096 Feb 19 19:57 186ab752-f128-48bb-9783-606a6be6dcec
drwx------    6 2000     2000          4096 Feb 19 20:12 7b937f9e-8e69-4248-845a-be39f74ad110
drwx------    7 2000     2000          4096 Feb 19 19:44 9a4c91c1-75dd-4e88-9bc8-4268a7ca7cbc
drwxr-xr-x    1 2000     root          4096 Feb 19 19:46 plugin-cache

[turkenf]

/test-examples="examples/cluster/workspace-inline-aws.yaml"

[ytsarev]

Validated e2e with the test build of xpkg.upbound.io/solutions/provider-opentofu:v1.0.0-16.gba423dc

k get workspaces.opentofu.upbound.io
NAME                                  SYNCED   READY   AGE
example-iam-with-entrypoint-always    True     True    10m
example-iam-with-entrypoint-outputs   True     True    13m

~ $ ls -la /tofu/
total 24
drwxr-xr-x    1 2000     root          4096 Feb 20 16:36 .
drwxr-xr-x    1 root     root          4096 Feb 20 16:36 ..
drwx------    6 2000     2000          4096 Feb 20 16:46 50fcfe95-2a44-46d3-a6f5-94af0434ed74
drwx------    6 2000     2000          4096 Feb 20 16:36 97f76c44-2e15-423d-8ce5-c4153c0c3b0c
drwxr-xr-x    1 2000     root          4096 Feb 20 16:36 plugin-cache

Always was pulled after the standard 10m reconciliation poll interval
IfNotPresent persisted the original timestamp

Stuff works 💪

I left minor suggestions inline.