[mirror] Fix --deckhouse-tag pull fail on unrelated suspended

[Glitchy-Sheep]

Summary

d8 mirror pull --deckhouse-tag vX.Y.Z failed when any release channel in the source registry was suspended, even if the requested version had nothing to do with that channel.

Now a suspension blocks the pull only when the requested tag actually matches the suspended channel.

Problem

• Release channels are read even for tag-pinned pulls: each channel's version.json is needed to check if the tag matches a channel by name or by version
• The suspend check lived inside that read loop (getReleaseChannelVersionFromRegistry)
• So any suspended channel failed the whole pull before we knew if the tag relates to it:

Error executing command: pull failed: pull from registry: pull platform:
  find tags to mirror: Find versions to mirror: failed to fetch release
  channel versions: failed to get release channel version from registry
  for channel rock-solid: source registry contains suspended release
  channel "rock-solid", try again later (use --ignore-suspend to override)

• The Skipped releases lookup ... log line made it worse: it reads as "channels are not polled at all", while only the version range discovery is skipped

Fix

• Reading a channel no longer fails on suspend - getReleaseChannelInfoFromRegistry (renamed from getReleaseChannelVersionFromRegistry) returns releaseChannelInfo: the version plus the suspended flag (the version is still needed for tag matching)
• The check moved to versionsToMirror, after matchChannelsToTags: new checkSuspendedChannels refuses the pull only when a matched channel is suspended
• Full discovery matches every channel, so any suspension is still fatal there, as before
• A tag matching a suspended channel by name or by version is still refused (its alias would go into the bundle); --ignore-suspend stays the override
• A suspended channel never gets into the download list
• A suspended LTS still counts as present, so missing default channels stay non-fatal for CSE registries
• The log line now reads Skipped releases range discovery ...

Before / After

Before: d8 mirror pull --deckhouse-tag v1.75.6 failed with suspended release channel "rock-solid" although v1.75.6 is not the rock-solid version.

After: the same command succeeds and the suspended channel's alias is left out of the bundle. Requesting the suspended channel itself (by name or its current version) still fails without --ignore-suspend.

Tests

Verified live against registry.deckhouse.io/deckhouse/ce with the currently suspended beta channel:

• the pre-fix binary reproduces the reported error
• the fixed binary builds a pull plan for v1.75.6
• it still refuses v1.76.3 (beta's current version) without --ignore-suspend

Dependencies

Bumped Go libraries pulled by our own code to clear CVE scanner findings in the bundled d8:

• golang.org/x/crypto v0.49.0 -> v0.54.0
• golang.org/x/image v0.39.0 -> v0.44.0
• golang.org/x/net v0.52.0 -> v0.57.0
• golang.org/x/sys v0.42.0 -> v0.47.0