add basic plumbing for provider startup checks

[jastang]

Description of your changes

This PR proposes a simple approach to enable custom startup checks on the provider by updating the main.go.tmpl. As a concrete example, users may run their workloads in highly regulated environments where the provider should not start if the environment is not properly configured.

This implements the default path, which is a no-op. It uses a combination of an init() hook and go build tags to:

• minimize code branching (build-time isolation)
• ensure critical checks run before anything else (fail fast)
• not require access to additional flags, env, or setup

A (simplified) example of an alternative implementation is building images with a compliance check (e.g. running in a FIPS-enabled host). What that would look like is:

• add internal/bootcheck/fips.go
  • add the build tags and adjust the default as needed.

       //go:build fips
       // +build fips
  

• build the images as before with GO_TAGS=fips to produce images targeting that specific compliance check.

I have:

• Read and followed Crossplane's contribution process.
• Run make generate and committed the results (ideally in a separate commit).
• Not made any manual changes to generated files, and verified this with make check-diff.

How has this code been tested

Locally building and installing the xpkg.

[sergenyalcin]

Thanks @jastang LGTM!