feat: enforce workload authorization and pod delete permissions on AuthProxyWorkload

[hessjcg]

Description

This PR implements admission webhook authorization validation for AuthProxyWorkload resources. It addresses the security requirement ensuring that users creating or updating an AuthProxyWorkload resource possess sufficient RBAC permissions to modify the targeted workload and pods.

Changes

1. SubjectAccessReview (SAR) Authorization Check in Validating Webhook:

   • Pod Delete Permission: Verifies the requester has delete verb on core/pods in the target namespace.
   • Workload Update/Patch Permission:
     • When a workload is referenced by name (spec.workload.name): checks update and patch permissions on that specific named resource (deployments, statefulsets, daemonsets, replicasets, jobs, cronjobs, or pods).
     • When a workload is selected by label selector (spec.workload.selector): checks namespace-wide update and patch permissions on the resource kind.
   • Container Override Permission: Verifies the user has create permission on the authproxyworkloads/containeroverride subresource when specifying custom authProxyContainer image/commands/args.
   • Metadata Update Optimization: Skips authorization check during ValidateUpdate if spec is unchanged (!reflect.DeepEqual(old.Spec, newObj.Spec)), allowing controller manager finalizer management without obstruction.

2. RBAC & Controller Updates:

   • Added RBAC annotations for batch/jobs and batch/cronjobs (update, patch) to the operator ClusterRole.
   • Added RBAC annotation for authorization.k8s.io/subjectaccessreviews (create).

3. Unit & E2E Tests:

   • Added comprehensive unit tests covering authorized and unauthorized scenarios across named resources, label selectors, container overrides, and spec updates.
   • Verified that all unit tests and GKE end-to-end integration tests (public & private clusters) pass cleanly.