Add offline bootstrap artifact config and E2E coverage

[bcho]

Summary

• upgrade Unbounded to the offline bootstrap support branch
• expose bootstrap.ociImage, components.sandboxImage, and bootstrap.offlineArtifacts.source in public config
• pass offline artifact source through to Unbounded AgentConfig
• add a dedicated E2E offline-artifacts VM/node using ghcr.io/azure/agent-ubuntu2404:v20260619 and ghcr.io/azure/unbounded/bootstrap-artifacts:alpha-0cd4fe2-k8s-{{ .KubernetesVersion }}

Validation

• go test ./...
• E2E workflow passed: https://github.com/Azure/AKSFlexNode/actions/runs/28556144289

Notes

The offline node still emits task names like download-kube-binaries/download-cri-binaries because those are the existing provisioning task names. In offline mode, Unbounded resolves those artifact sources from bootstrap.offlineArtifacts.source rather than from upstream defaults. The E2E signal that this path was used is that the offline node bootstrapped with manifest-driven containerd 2.1.8 while the normal token/kubeadm nodes used the explicitly configured 2.0.4.