add finaliser to GPUCluster CR using PATCH

[tariq1890]

This PR adds a new util method to add a finaliser to the GPUCluster custom resource. It also uses PATCH to add the finaliser as it's safer and more robuse to race conditions around object updates.

h/t to @rajathagasthya for pointing me to the method in CAPI that inspired this change

[coveralls]

coverage: 33.505% (-0.04%) from 33.544% — ensure-finaliser into main

[tariq1890]

/ok to test a4248cf

[tariq1890]

Thanks for the review @rahulait. I updated the PR to address a review comment from Claude and also added unit tests

 Missing optimistic lock (internal/utils/utils.go:179): client.MergeFrom generates a patch with no resourceVersion, so the API server applies it without conflict detection. Two concurrent reconcilers can silently clobber each other's finalizers. The old r.Update included resourceVersion and would have 409'd. Fix: replace client.MergeFrom(original) with client.MergeFromWithOptions(original, client.MergeFromWithOptimisticLock{}).