Bump rpm deps for 4k sector block device fix - #4179

## What this PR does

CDI v1.64.0 -> v1.66.1, operator manifest refetched with `make update`.

The bump was stuck since v1.65.0: its bundled qemu-img broke HTTP
imports to block volumes on 4Kn devices (DRBD/LINSTOR). This PR first
targeted v1.66.0 on the assumption that
kubevirt/containerized-data-importer#4179 had closed it, and that was
wrong: the qemu-img in the v1.66.0 importer is 10.1.0-21.el9, which does
not carry the first-sector fix, and the E2E run on that head failed
exactly there. The fix is in 10.1.0-24.el9, which reached the release
branch through kubevirt/containerized-data-importer#4274 and shipped in
v1.66.1. Verified by running the released image: `cdi-importer:v1.66.1`
reports `qemu-img version 10.1.0 (qemu-kvm-10.1.0-24.el9)`.

The other v1.64.0 symptom is a resourceVersion storm on the prime PVC
during WFFC imports, which makes the scheduler retry FailedScheduling
dozens of times per import; it was reported by a production user
importing golden images on a local StorageClass. That one is fixed by
commit e547586e9, a one-line guard in `updatePvcFromPod` that clears the
bound-condition annotations only when they came from scratch-space
creation. It is in v1.66.0 and later. The commit is squashed under a
title about kubevirtci lanes, so it appears in no release note and
searching for it by symptom finds nothing.

Two local edits to the vendored manifest survive refetches now. The
startupProbe patch gets the correct -p4 strip level, as written it never
applied from the package directory. The control-plane tolerations were
hand-edited into the manifest with no patch behind them, so any refetch
silently dropped them; they live in patches/tolerations.diff now. `make
update` round-trips to a byte-identical file.

Behavior changes checked against this repo: /metrics on CDI components
now requires a bearer token, nothing here scrapes it. Scratch PVCs
inherit the target StorageClass instead of the cluster default (since
v1.65.0). The PVC-rendering webhook is always registered now, but only
matches PVCs labeled cdi.kubevirt.io/applyStorageProfile=true, which
nothing here sets.

### Screenshots

Not a UI change.

### Downstream repositories

- [x] No downstream repository is affected by this change
- [ ] [cozystack/website](https://github.com/cozystack/website) -
follow-up:
- [ ]
[cozystack/terraform-provider-cozystack](https://github.com/cozystack/terraform-provider-cozystack)
- follow-up:
- [ ]
[cozystack/ansible-cozystack](https://github.com/cozystack/ansible-cozystack)
- follow-up:
- [ ] [cozystack/ccp](https://github.com/cozystack/ccp) - follow-up:
- [ ] [cozystack/talm](https://github.com/cozystack/talm) - follow-up:
- [ ] [cozystack/cozyhr](https://github.com/cozystack/cozyhr) -
follow-up:
- [ ] [cozystack/cozy-proxy](https://github.com/cozystack/cozy-proxy) -
follow-up:
- [ ]
[cozystack/cozystack-telemetry-server](https://github.com/cozystack/cozystack-telemetry-server)
- follow-up:
- [ ]
[cozystack/external-apps-example](https://github.com/cozystack/external-apps-example)
- follow-up:
- [ ] [cozystack/examples](https://github.com/cozystack/examples) -
follow-up:

### Release note

```release-note
fix(cdi): update CDI to v1.66.1. Fixes HTTP imports to block volumes on 4Kn devices (DRBD/LINSTOR) with the repaired qemu-img, and the resourceVersion storm on prime PVCs during WaitForFirstConsumer imports.
```


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **New Features**
* Added Kubernetes tolerations for critical add-on and control-plane
nodes.
* Added resource claim requests and webhook PVC rendering configuration
to CDI custom resources.
* Added permissions for token reviews, metrics, and profiling endpoints.
  * Updated affinity feature-gate documentation to beta status.

* **Improvements**
  * Updated CDI operator and operand images to version 1.66.1.
  * Refreshed Kubernetes schema metadata and deployment configuration.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->