fix(renovate): track ghcr.io/adobe/koperator/kafka -jdk<version> tags

[amuraru]

Summary

• The 3.9.2 Kafka image was published as 2.13-3.9.2-jdk21.0.11 instead of the plain 2.13-3.9.2 shape prior releases used, so the ghcr.io/adobe/koperator/kafka packageRule's matchCurrentValue/versioning regex (scoped to the plain shape only) couldn't see it as a valid version. Renovate silently had nothing to bump, and chore(deps): update all non-major dependencies (master) #302 shipped with DefaultKafkaImage still on 3.9.1.
• Extend the versioning regex to parse an optional -jdk<major>.<interim>.<update> suffix, mapping jdk major/update onto the regex-versioning module's build/revision slots so both tag shapes compare correctly. This does not gate jdk-major jumps (e.g. jdk21.x -> jdk25.x) the way compatibility gates the scala prefix - that's deferred to the same operator-side migration already planned for the apache/kafka 4.x bump (see docker/kafka/Dockerfile's java_version comment).
• One-time manual cutover of DefaultKafkaImage/defaultKafkaImage to the now-current 2.13-3.9.2-jdk21.0.11 tag; Renovate will track further -jdk<version> bumps automatically going forward. The remaining config/samples/**/docs/benchmarks/** references still pinned to 3.9.1 are left for Renovate's own follow-up PR (same customManager/packageRule now covers them) rather than hand-edited here.

Test plan

• renovate-config-validator passes against the updated renovate.json
• renovate --platform=local --dry-run=full against the live registry confirms currentValue: "2.13-3.9.1" -> newValue: "2.13-3.9.2-jdk21.0.11", updateType: "patch", with zero warnings/errors, across every annotated occurrence
• go build ./... and go vet ./... pass in both the root module and the api/ submodule
• go test ./api/v1beta1/... passes
• Confirmed the 4 hardcoded 2.13-3.9.1 string literals in controllers/**/*_test.go are independent fixture pins (not references to the changed constants), so they're unaffected

🤖 Generated with Claude Code