Disable HTTP/2 by Default for Webhooks to Mitigate CVE Risks

- Ensure HTTP/2 is disabled when the enable-http2 flag is set to false (default).
- Disabling HTTP/2 mitigates vulnerabilities associated with:
  - HTTP/2 Stream Cancellation (GHSA-qppj-fm5r-hxr3)
  - HTTP/2 Rapid Reset (GHSA-4374-p667-p6c8)
- While CVE fixes exist, they remain insufficient; disabling HTTP/2 helps reduce risks.
  For details, see:
  - GHSA-qppj-fm5r-hxr3
  - GHSA-4374-p667-p6c8
  - golang/go#63417

cmd/manager/main.go

@@ -193,9 +193,7 @@ func main() {
 	webhookServer := crwebhook.NewServer(crwebhook.Options{
 		Port: webhookPort,
 		TLSOpts: []func(*tls.Config){
-			func(cfg *tls.Config) {
-				cfg.GetCertificate = cw.GetCertificate
-			},
+			tlsOpts,
 		},
 	})