Optionally collect, display, and confirm helmfile diffs

This adds the --k8s-confirm-diffs flag, which if specified will make scap collect and display helmfile diffs and await confirmation before proceeding with deployment.

This review happens early, before operations with side effects (e.g., image build). This comes at the expense of a longer window during which an unexpected helmfile or chart change can sneak in.

Since the loop over deployment datacenters and configs is identical to that in _deploy_to_datacenters, the inner part of the latter has been abstracted out (_foreach_datacenter_and_deployment) and is reused in both the diff and apply context.

Bug: T362717