Wire security.kubernetes.tls.minVersion into the Kubernetes API client transport

[Elmo33]

• Under FIPS/Enforced, the operator already coerced security.kubernetes.tls.minVersion to 1.3 in chopconf but never applied it when building the client-go transport, so the K8s client could still negotiate TLS 1.2.
• Resolve the effective floor from file-based chopconf at GetClientset time (same timing as the insecure-kubeconfig startup gate) via OperatorConfig.ResolveK8sTLSMinVersion, and stamp it onto rest.Config with Wrap.
• Pass chopConfigFile into GetClientset from the operator, keeper, and metrics-exporter entrypoints so all three binaries share the same behavior.

Important items to consider before making a Pull Request

Please check items PR complies to:

• All commits in the PR are squashed. More info
• The PR is made into dedicated next-release branch, not into master branch¹. More info
• The PR is signed. More info