fix: lock rke2-common and pin rke2 to 1.33.13~rke2r2 to unblock puppet

## Why

k8s nodes fail every puppet run on Package[rke2-server] and stop
applying the rest of their catalog (no further package/config updates):

  change from '1.33.4~rke2r1-1.el9' to '1.33.11~rke2r1' failed:
  dnf upgrade rke2-server-1.33.11~rke2r1 returned 1:
  Problem: problem with installed package rke2-common-1.33.13~rke2r2-0.el9
   - package rke2-server-1.33.11~rke2r1 requires rke2-common = 1.33.11~rke2r1,
     but none of the providers can be installed
   - cannot install the best update candidate for rke2-server

The module versionlocks only rke2-server/rke2-agent, not their strict
(= version) rke2-common dependency. rke2-common is pulled from the
rolling rancher-rke2-1.33-latest channel, whose head is now
1.33.13~rke2r2, so rke2-common drifted up to 1.33.13~rke2r2 while the
pin sat at 1.33.11~rke2r1. dnf upgrade can't downgrade the newer
rke2-common to satisfy the older server, so the transaction fails.

## Changes

- Versionlock rke2-common to the same ${rke2_version}~${rke2_release} as
  the server/agent, so the rolling channel can no longer drift the
  dependency ahead of the pin.
- Bump rke2_version 1.33.11 -> 1.33.13 and rke2_release rke2r1 -> rke2r2
  to match the current channel head (and the already-drifted installed
  rke2-common), so the pinned server/agent, versionlocks, and preloaded
  airgap bundle all resolve in one transaction.

modules/rke2/manifests/install.pp

@@ -12,6 +12,12 @@ class rke2::install (
     version => "${rke2_version}~${rke2_release}",
   }
 
+  # lock rke2-common (a strict = version dep) so the rolling latest channel can't drift it ahead of the pinned server/agent
+  yum::versionlock{'rke2-common':
+    ensure  => present,
+    version => "${rke2_version}~${rke2_release}",
+  }
+
   # install rke2
   package {"rke2-${node_type}":
     ensure => "${rke2_version}~${rke2_release}",

modules/rke2/manifests/params.pp

@@ -1,8 +1,8 @@
 # rke2 params
 class rke2::params (
   Enum['server', 'agent'] $node_type = 'agent',
-  String                  $rke2_version = '1.33.11',
-  String                  $rke2_release = 'rke2r1',
+  String                  $rke2_version = '1.33.13',
+  String                  $rke2_release = 'rke2r2',
   Stdlib::Absolutepath    $config_file = '/etc/rancher/rke2/config.yaml',
   Hash                    $config_hash = {},
   Stdlib::HTTPSUrl        $join_url = 'https://127.0.0.1:9345',