feat(kustomize): allow deterministic renderer selection

[lokesh0186]

Allow deterministic Kustomize implementation selection

Closes #7600

Summary

Add a closed --kustomize-command {auto,kubectl,kustomize} option, with matching CKV_KUSTOMIZE_COMMAND and YAML kustomize-command configuration.

• auto preserves Checkov's existing kubectl-first behavior.
• kubectl selects only kubectl kustomize.
• kustomize selects only standalone kustomize build.
• Explicit selection does not silently fall back when the chosen tool is missing, unusable, or fails.
• Commands remain fixed argument arrays; arbitrary executable paths and shell strings are not accepted.

Configuration precedence

The implementation follows Checkov's existing configargparse precedence:

CLI > environment > YAML configuration > default

The default remains auto, so existing users retain current behavior.

Failure behavior

A missing or unusable explicitly selected implementation is reported as an invalid invocation and normally exits 2. Checkov's existing --no-fail-on-crash option changes the shell exit to 0 while retaining the diagnostic; the documentation and tests state this interaction explicitly.

An explicitly selected implementation that starts but exits nonzero is never replaced by the other implementation.

Relationship to #7615

This change controls which Kustomize implementation is selected. It does not change build-error reporting.

I tested this branch on top of #7615's current head. Explicitly selected build failures continue to produce parsing-error evidence, and no fallback to the other implementation occurs.

Tests

Added native tests for:

• default auto behavior;
• explicit kubectl and standalone selection;
• CLI, environment, YAML, and default precedence;
• invalid closed-choice values;
• missing and unusable selected tools;
• selected build failures and no fallback;
• --show-config and --create-config;
• --no-fail-on-crash interaction;
• compatibility with the current fix(kustomize): surface non-zero build failures as parsing errors #7615 head.

Existing Kustomize/config suites, pre-commit hooks, import-linter, mypy, package build, and clean-wheel import smoke pass.