Brings two upstream fixes CDI v1.64.0 users hit in the field:

- qemu-img 10.1.0-24.el9 restores HTTP imports to block volumes on
  4Kn devices (DRBD/LINSTOR), the regression that kept this repo
  from following v1.65.0. The earlier -21 build shipped in v1.66.0
  did not carry the fix, which is why this targets v1.66.1.
- import-controller no longer clears event-based bound-condition
  annotations on every pod sync, removing the resourceVersion storm
  on prime PVCs during WFFC imports that starved the scheduler with
  FailedScheduling retries. The fix is commit e547586e9, a one-line
  guard in updatePvcFromPod that rides inside a squash titled after
  its kubevirtci changes, so neither the release notes nor the pull
  request title mention it.

The operator manifest is refetched with make update. Two local
customizations survive as patches now: the startupProbe patch gains
the correct -p4 strip level (it never applied from the package
directory as written), and the control-plane tolerations that were
hand-edited into the manifest since v0.0.1 move into
patches/tolerations.diff so the next refetch cannot drop them.

Behavioral notes for this bump: CDI /metrics now requires a bearer
token (nothing in this repo scrapes it); scratch PVCs inherit the
target StorageClass instead of the cluster default; the PVC-rendering
webhook is always registered but only matches PVCs labeled
cdi.kubevirt.io/applyStorageProfile=true, which nothing here sets.

Assisted-by: LLM
Signed-off-by: Aleksei Sviridkin <[email protected]>
(cherry picked from commit 44b95e7)