add basic plumbing for provider startup checks.

[jastang]

Description of your changes

Similar to crossplane-contrib/provider-upjet-aws#1818, this PR proposes a simple approach to enable custom startup checks on the provider by updating the main.go.tmpl. As a concrete example, users may run their workloads in highly regulated environments where the provider should not start if the environment is not properly configured.

This implements the default path, which is a no-op. It uses a combination of an init() hook and go build tags to:

• minimize code branching (build-time isolation)
• ensure critical checks run before anything else (fail fast)
• not require access to additional flags, env, or setup

A (simplified) example of an alternative implementation is building images with a compliance check (e.g. running in a FIPS-enabled host). What that would look like is:

• add internal/bootcheck/fips.go
  • add the build tags and adjust the default as needed.

       //go:build fips
       // +build fips
  

• build the images as before with GO_TAGS=fips to produce images targeting that specific compliance check.

I have:

• Read and followed Crossplane's [contribution process].
• Run make reviewable to ensure this PR is ready for review.
• Added backport release-x.y labels to auto-backport this PR if necessary.

How has this code been tested

local build and install.
[contribution process]: https://git.io/fj2m9