test(kubernetes): cover conflict retry and no-retry on 403 (000333)

Add fake-clientset unit tests for the conflict retry in Update():

- TestUpdateRetriesOnConflict: first update returns 409 Conflict, the
  second succeeds; asserts Update() returns nil, both attempts carry
  the fresh resourceVersion from the re-fetch, and the stored object
  was updated with the new image and resourceVersion.
- TestUpdateDoesNotRetryOnForbidden: 403 Forbidden is returned
  immediately with exactly one update attempt.

The implementer's unexported client field now uses kubernetes.Interface
so a fake clientset can be injected in tests; Client() keeps its
*kubernetes.Clientset signature.

Part of #818.

Spec-Ref: helix-specs@e0e887cf:000333_retry-conflict-on-update