feat(mongodb): support MongoDB 9.0 and make 9.0.2 default

[KeiaiLab-PHIL]

What / why

User instruction 2026-10-06 "mongodb 최신 메이저버전 적용": MongoDB 9.0 becomes supported and the default; the exporter default moves to 0.53.0; upstream images are whitelisted in the Artifact Hub scan.

• supportedMongoDBList = 8.0 / 8.2 / 8.3 / 9.0 (v1alpha1 + v1beta1).
• Upgrade path: IsValidUpgradePath used to reject every major change, so 8.3 → 9.0 was blocked. New checkMajorStep admits exactly one cross-major step: last supported minor of N → first supported minor of N+1 (8.3 → 9.0). 8.0/8.2 → 9.0 and 9.0 → 8.x stay rejected.
  • Why 8.3 specifically: 9.0 binaries start only with FCV = lastContinuous (8.3) or lastLTS (8.0). The operator commits FCV to the target minor after each validated upgrade (commitFCV / commitShardedFCV → fcvMajorMinor), so a cluster that walked 8.0 → 8.2 → 8.3 sits at FCV 8.3, which 9.0 accepts. The binary rollout stays rollback-safe until validation passes, then FCV "9.0" is committed (same flow as the minor steps).
  • 8.0 → 9.0 is valid for MongoDB, but it is kept blocked to stay consistent with the existing adjacent-step rule (8.0 → 8.3 is blocked too).
• Defaults: mongo:9.0.2 (defaultImage, also used by the backup Job and the backup-verification StatefulSet), percona/mongodb_exporter:0.53.0 (kubebuilder default + exporterImage), chart values, crdsExamples, config/samples (+bundle samples, CSV alm-examples base), examples, docs (install / getting-started / i18n / chart README / README supported-version list).
• Chart artifacthub.io/images: mongo:9.0.2 and percona/mongodb_exporter:0.53.0 are whitelisted: true; the operator image stays scanned. SECURITY.md gets an "Upstream images" section.
• CRDs regenerated with make manifests generate + make sync-crds (note: manifests runs sync-crds before controller-gen, so a second sync-crds is needed to get the chart CRDs in step — pre-existing Makefile ordering).

Verification

• New table cases (written first, observed red: major version change "8.3" → "9.0" is not allowed), then green: 8.3→9.0 ok, 8.3.1→9.0.2 ok, 8.0→9.0 / 8.2→9.0 / 9.0→8.3 / 8.3→10.0 rejected, 9.0.0→9.0.2 patch ok.
• make test green · golangci-lint --new-from-rev=origin/main 0 issues · helm lint ok · make kube-lint pass · crane digest mongo:9.0.2 / percona/mongodb_exporter:0.53.0 exist.

Not verifiable without a cluster

• A real 8.3 → 9.0 rolling upgrade (RS and sharded) with FCV 8.3 → 9.0 commit.
• mongot search sidecar and backup tooling (mongodump/mongorestore in mongo:9.0.2) against 8.x servers.
• Existing CRs that omit monitoring.exporter.image pick up the new CRD default 0.53.0 → exporter sidecar rolls once.
• Existing clusters are not changed by the chart bump: spec.version.version is required in the CR; chart mongodb.version only feeds an unused DEFAULT_MONGODB_VERSION env and NOTES.

🤖 Generated with Claude Code