[deckhouse-cli] Add noneOf and validate plugin contract module requirements

[Fkuloff]

Description

Adds the noneOf module-requirements bucket to the plugin contract and brings the
requirements.modules shape to parity with the package.yaml contract in
deckhouse-controller.

Before this the CLI had mandatory / conditional / anyOf (no noneOf), its groups
carried only a description (no name), and the contract was never validated. Now:

• noneOf bucket (forbidden module dependencies) alongside anyOf — parsed, serialized,
  and enforced. A noneOf group lists modules that must NOT be enabled; a member
  constraint narrows the forbidden version range, an empty constraint forbids any version.
• anyOf and noneOf share a single ModuleGroup type (like the controller's
  PackageModuleGroup), with a required name.
• ContractToDomain now validates the requirement groups, mirroring the controller's
  buildModuleGroups + validateBucketCollisions (unique non-empty group name, at least
  one member, unique members, valid constraints, no module in contradictory buckets), and
  returns an error so an ill-formed contract is rejected instead of loading silently.
• Enforcement: checkNoneOfModules, symmetric to checkAnyOfModules, blocks
  install/update when a forbidden module is enabled within its forbidden version range.
  Wired into validateModuleRequirement and HasClusterRequirements.

Testing

gofmt, go build, go vet, and go test pass. Coverage: contract parsing
(TestPluginContract_V2FieldsParsed), DTO → domain conversion
(TestContractToDomain_CarriesModuleGroups), requirement validation with per-rule error
assertions (TestContractToDomain_RejectsInvalidGroups), the cluster-check gate
(TestHasClusterRequirements), and noneOf enforcement
(TestValidateModuleRequirementNoneOf*).