feat: cross ns security

[zach-robinson-dev]

https://github.com/influxdata/starfleet/issues/184

Prevents the use of kubeconfig secrets outside of the ResourceSync's namespace except when the kubeconfig secret has the annotation sinker.influxdata.io/allowed-namespaces. The contents of the annotation must be a valid regex and Sinker requires that the ResourceSync's namespace matches the expression.

[Copilot]

Pull request overview

This PR implements a security feature that restricts cross-namespace access to kubeconfig secrets. ResourceSyncs can only use kubeconfig secrets from other namespaces if those secrets have the sinker.influxdata.io/allowed-namespaces annotation containing a regex pattern that matches the ResourceSync's namespace.

Key Changes:

• Added namespace-based access control for kubeconfig secrets via regex annotation
• Error messages for unauthorized access are masked to prevent information leakage
• Comprehensive test coverage including edge cases and concurrent access scenarios

Reviewed changes

Copilot reviewed 4 out of 5 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
src/resources.rs	Adds ALLOWED_NAMESPACES_ANNOTATION constant and changes visibility of annotation constants to pub const
src/resource_extensions.rs	Implements security validation logic in cluster_client() and adds verify_kubeconfig_secret_access() function with comprehensive tests
src/lib.rs	Adds UnauthorizedKubeconfigAccess error variant for security violations
Cargo.toml	Adds regex dependency (v1.12.2) for pattern matching
Cargo.lock	Updates lockfile with regex dependency and winnow version bump

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

The method random_range does not exist in the rand 0.9.x Rng trait. The correct method is gen_range. This should be:

let ns = format!("proj-{}", rng.gen_range(10_u8..99_u8));

Suggested change

	let ns = format!("proj-{}", rng.random_range(10_u8..99_u8));
	let ns = format!("proj-{}", rng.gen_range(10_u8..99_u8));