test(e2e): Add cross-namespace reference E2E tests

The --enable-cross-namespace flag, generated reference resolution code,
and Helm wiring already shipped upstream in iam-controller v1.7.2
(ACK runtime v0.60.0). This adds end-to-end test coverage for the
cross-namespace behavior across the three scenarios: flag enabled
(deprecation advisory), flag disabled (terminal rejection), and
same-namespace (always allowed).

Author: sapphirew