fix(translator): separate RefNotPermitted from InvalidCertificateRef handling

Unlike InvalidCertificateRef, RefNotPermitted should not set Accepted:True.
Update unit test fixtures to match.

Signed-off-by: apkatsikas <apkatsikas@gmail.com>

Author: apkatsikas

internal/gatewayapi/testdata/gateway-with-listener-with-invalid-tls-configuration-secret-in-other-namespace.out.yaml

@@ -28,11 +28,6 @@ gateways:
         reason: RefNotPermitted
         status: "False"
         type: ResolvedRefs
-      - lastTransitionTime: null
-        message: Listener has been successfully translated
-        reason: Accepted
-        status: "True"
-        type: Accepted
       - lastTransitionTime: null
         message: Listener is invalid, see other Conditions for details.
         reason: Invalid

internal/gatewayapi/testdata/listenerset-https-tls-misuses-gateway-namespace.out.yaml

@@ -134,9 +134,9 @@ listenerSets:
   status:
     conditions:
     - lastTransitionTime: null
-      message: All listeners are accepted
-      reason: Accepted
-      status: "True"
+      message: No listeners are accepted
+      reason: ListenersNotValid
+      status: "False"
       type: Accepted
     - lastTransitionTime: null
       message: No listeners are programmed
@@ -152,11 +152,6 @@ listenerSets:
         reason: RefNotPermitted
         status: "False"
         type: ResolvedRefs
-      - lastTransitionTime: null
-        message: Listener has been successfully translated
-        reason: Accepted
-        status: "True"
-        type: Accepted
       - lastTransitionTime: null
         message: Listener is invalid, see other Conditions for details.
         reason: ListenersNotValid

internal/gatewayapi/validate.go

@@ -299,7 +299,7 @@ func (t *Translator) validateListenerConditions(listener *ListenerContext) {
 			listener.SetCondition(gwapiv1.ListenerConditionProgrammed, metav1.ConditionTrue, gwapiv1.ListenerReasonProgrammed,
 				"Sending translated listener configuration to the data plane")
 			return
-		case string(gwapiv1.ListenerReasonInvalidCertificateRef), string(gwapiv1.ListenerReasonRefNotPermitted):
+		case string(gwapiv1.ListenerReasonInvalidCertificateRef):
 			// The listener configuration is semantically valid, but the listener cannot serve traffic with an invalid certificate.
 			listener.SetCondition(gwapiv1.ListenerConditionAccepted, metav1.ConditionTrue, gwapiv1.ListenerReasonAccepted,
 				"Listener has been successfully translated")