[deckhouse-cli] add --include-platform flag for platform release range mirroring

[ldmonster]

Summary

Adds --include-platform to d8 mirror pull. It accepts the same semver-constraint syntax that --include-module uses for module version pinning, letting users download a bounded window of platform releases in a single command without having to run separate pulls.

Typical use-case: incremental air-gap update from Deckhouse v1.63 to v1.71, where the operator wants to download only the v1.64–v1.68 delta first:

d8 mirror pull \
  --include-platform '>=1.64 <=1.68' \
  --license=$LICENSE_TOKEN \
  ./bundle

Changes

New --include-platform flag (flags.go, validation.go, pull.go)

• --include-platform accepts any constraint expression valid for --include-module's version part: semver ranges (>=1.64 <=1.68), tilde/caret shorthands (~1.65.0, ^1.65.0), bare version strings (1.65.0 → implicit caret), and exact-tag pins (=v1.65.3, =v1.65.3+stable).
• Mutually exclusive with --deckhouse-tag and --since-version at both the cobra and validation levels. Clear error messages guide the user when a forbidden combination is used.
• PlatformConstraint modules.VersionConstraint threaded through PullServiceOptions → platform.Options.

Platform service constraint application (platform.go)

Exact-tag constraints (=vX.Y.Z) are handled by synthesizing options.TargetTag at the top of PullPlatform, so they reuse the already-tested --deckhouse-tag code path for registry validation, channel propagation, and dry-run output verbatim.

Semver constraints (>=X <=Y, ~X, ^X, …) introduce a dedicated expansion path in expandVersionRange:

1. All registry release tags are fetched via ReleaseChannels().ListTags.
2. Tags that satisfy the constraint are filtered through parseTagsMatchingConstraint.
3. filterOnlyLatestPatches collapses multiple patches in the same (major, minor) to the newest — matching how the default full-discovery path behaves.
4. restoreInclusiveAnchors re-adds versions that were explicitly named with >= / <= in the user's expression but were dropped by the latest-patch filter (the user named them by hand; silently dropping them would override an explicit choice).
5. --since-version is still honoured as an additional lower clamp when set alongside the constraint.
6. Release channels whose current snapshot points outside the constraint are pruned in versionsToMirror via filterChannelsByConstraint, so the bundle never references tags that were not downloaded.

modules.ParseVersionConstraint export (filter.go)

The constraint parser that NewFilter already uses internally is now exported as ParseVersionConstraint. This makes the platform path a consumer of the same parser instead of duplicating the dialect, ensuring both flags speak exactly the same constraint language.