add scc-air-gapped option

This MR introduces the "🛠️ scc-air-gapped" option: a configuration aiming at check that what is deployed by sylva-capi-cluster does not make use of an HTTP proxy (proxy settings as still enabled in the rest of the stack).

A typical example, and the motivation for this MR, is to check that the containerd configuration that sylva-capi-cluster generates makes use of registry_mirrors as desired, by preventing any fallback of the Internet registries which would be reachable via an HTTP proxy.

Tested in sylva-projects/sylva-core!8135 (closed)

With this MR, the currently broken support that we have for registry_mirrors in ~kubeadm setups, now trigger a direct error instead of silently ignoring registry_mirrors:

(from https://gitlab.com/sylva-projects/sylva-core/-/jobs/14744143916/artifacts/file/management-cluster-dump/node_logs/mgmt-2584895130-kubeadm-capo-control-plane-724v8/system---var-log/syslog)

Jun  8 13:01:12 mgmt-2584895130-kubeadm-capo-control-plane-724v8 containerd[1529]: time="2026-06-08T13:01:12.491518553Z" level=info msg="fetch failed" error="failed to do request:
 Head \"https://registry.k8s.io/v2/kube-apiserver/manifests/v1.35.3\":smiley:
 dial tcp 34.96.108.209:443: i/o timeout" host=registry.k8s.io
Jun  8 13:01:12 mgmt-2584895130-kubeadm-capo-control-plane-724v8 containerd[1529]: time="2026-06-08T13:01:12.508034530Z" level=info msg="stop pulling image registry.k8s.io/kube-apiserver:v1.35.3: active requests=0, bytes read=0"
Jun  8 13:01:12 mgmt-2584895130-kubeadm-capo-control-plane-724v8 containerd[1529]:
 time="2026-06-08T13:01:12.508112737Z" level=error msg="PullImage \"registry.k8s.io/kube-apiserver:v1.35.3\" failed"
 error="rpc error: code = DeadlineExceeded desc = failed to pull and unpack image \"registry.k8s.io/kube-apiserver:v1.35.3\":
 failed to resolve image: failed to do request:
 Head \"https://registry.k8s.io/v2/kube-apiserver/manifests/v1.35.3\":
 dial tcp 34.96.108.209:443: i/o timeout"

We see containerd failing to download the very first images that are needed.

The "🛠️ scc-air-gapped" option will help validate the fixes for sylva-projects/sylva-core#4135 (closed).