karmadactl init does not validate --cert-external-ip, invalid IPs silently become 127.0.0.1 in the cert

**What happened**: I passed an invalid IP to `--cert-external-ip` during `karmadactl init`. Instead of getting an error, init finished fine, but the value was silently turned into `127.0.0.1` in the generated certificate. The flag value goes through `utils.FlagsIP` -> `utils.StringToNetIP`, and that function returns `127.0.0.1` whenever the input can't be parsed as an IP. pkg/karmadactl/cmdinit/utils/format.go: ```go func StringToNetIP(addr string) net.IP { if ip := net.ParseIP(addr); ip != nil { return ip } return net.ParseIP("127.0.0.1") } ``` It's used here while building the cert SANs in pkg/karmadactl/cmdinit/kubernetes/deploy.go: ```go karmadaIPs := utils.FlagsIP(i.ExternalIP) ``` `--karmada-apiserver-advertise-address` is validated in `Validate()` and errors on a bad IP, but `--cert-external-ip` isn't validated anywhere, so a typo just slips through. **What you expected to happen**: init should reject an invalid `--cert-external-ip` with a clear error, the same way it already does for `--karmada-apiserver-advertise-address`. Silently signing the cert for `127.0.0.1` instead of the IP I asked for is surprising. **How to reproduce it (as minimally and precisely as possible)**: ``` kubectl karmada init --cert-external-ip 192.168.1.300 ``` `192.168.1.300` is not a valid IP. init does not complain, and the resulting Karmada cert ends up with `127.0.0.1` in its SAN list instead of the intended address. **Anything else we need to know?**: The real effect shows up later as a confusing TLS error like `x509: certificate is valid for 127.0.0.1, not <ip>` when you reach the API server through that address, which is hard to trace back to init since init reported success. I think the fix is to validate `i.ExternalIP` in `Validate()` (split on comma, parse each entry), matching how the advertise address is already handled. Happy to work on this. **Environment**: - Karmada version: master - kubectl-karmada or karmadactl version (the result of `kubectl-karmada version` or `karmadactl version`): built from master - Others: only affects `karmadactl init` when `--cert-external-ip` is set