code rabbit comment for outside of pr 100

Inline comments:
In @internal/controller/vmwarecloudfoundationmigration_controller.go:

• Around line 1689-1690: Extend the migration phase API enum with
  PhaseDestinationImageImported, add the corresponding value to both CRD manifests
  and the allPhases list used by UpdateMigrationMetrics, and update
  conditionToPhase to explicitly map ConditionDestinationImageImported to that
  phase. Add coverage for the condition mapping and emitted metric label.

Outside diff comments:
In @bundle/manifests/vcf-migration-operator.clusterserviceversion.yaml:

• Around line 284-288: Update the container securityContext in the
  vcf-migration-operator ClusterServiceVersion to set readOnlyRootFilesystem to
  true, while preserving /tmp/ova-scratch as the writable workspace through its
  existing volume configuration.

In @internal/controller/vmwarecloudfoundationmigration_controller.go:

• Line 635: Update the OVA download flow used by downloadOVAToDir and the
  vsphere.DownloadOVA call to enforce an administrator-controlled host allow-list,
  validate resolved IPs to reject private or reserved ranges, and apply the same
  checks to every redirect target before connecting. Do not use http.DefaultClient
  without these validations, and fail the download when any initial or redirected
  destination is not permitted.

After applying the fix, consider running coderabbit review --agent for local
review. Visit https://docs.coderabbit.ai/cli.

Begin in internal/controller/vmwarecloudfoundationmigration_controller.go, examining the migration phase enum, allPhases, conditionToPhase, downloadOVAToDir, and the vsphere.DownloadOVA call. Also inspect bundle/manifests/vcf-migration-operator.clusterserviceversion.yaml and the existing /tmp/ova-scratch volume configuration. Done means the phase and metric coverage exists, the securityContext is read-only, and initial plus redirected OVA destinations pass the required allow-list and IP checks.