feat(cli): add update check and upgrade command

[tkkhq]

Summary

• check GitHub latest release on normal CLI startup and warn when a newer stable version exists
• add volcano upgrade to download the latest release asset, verify Sigstore via cosign, verify SHA256SUMS, and replace the running binary
• add tests for version comparison, update notices, skipped commands, upgrade replacement, signature invocation, and checksum mismatch

Verification

• go test ./internal/cmd/root ./internal/update

Blocked / Known Limitation

• Manual end-to-end testing against real GitHub releases is blocked while Kong/volcano-cli releases are private. Unauthenticated calls to https://api.github.com/repos/Kong/volcano-cli/releases/latest return 404, so the CLI correctly suppresses the startup notice. Tests use httptest release endpoints to cover the feature without depending on repo visibility.

Note

• This PR was recreated from the rewritten origin/main history by cherry-picking the previous feature commit onto a fresh branch.

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}