WAF: CoreRuleset update to v3.3.4

[electricjesus]

Description

Fix: use appropriate CRS rules, setup files and engine (in dikastes) versions together:

• fix CRS version to v3.3.4
• Use correct modsecdefault.conf version that should go with it
• Don't set SecRuleEngine is now DetectionOnly by default to minimize post-install disruption

This should reduce false detections due to configuration mismatch(es)

Feat: updater Make target

• workflow for keeping CRS files up-to-date
• replace gen.go strategy with embed.FS
• not yet connected to CI dirty checks so updates aren't detected automatically

To use:

make generate-crs

For PR author

• Tests for change.
• If changing pkg/apis/, run make gen-files
• If changing versions, run make gen-versions

For PR reviewers

A note for code reviewers - all pull requests must have the following:

• Milestone set according to targeted release.
• Appropriate labels:
  • kind/bug if this is a bugfix.
  • kind/enhancement if this is a a new feature.
  • enterprise if this PR applies to Calico Enterprise only.