contrib: add kcp schema serving

[mjudeikis]

Summary

Enables kube-bind to serve resources in a 3-tier kcp topology where the backend workspace has no APIExport of its own — only an APIBinding that binds from an upstream provider workspace.

Problem

Standard kube-bind + kcp is 2-tier: :root:provider owns the APIExport, consumer binds via kube-bind. This PR adds a 3-tier model:

:root:provider   — owns APIResourceSchema + APIExport
      |  (APIBinding)
      v
:root:backend    — binds from provider; kube-bind backend runs here
      |  (kube-bind serving)
      v
  consumer       — binds resources via kube-bind

The backend has no APIExport — previously, this made it impossible to serve resources since kube-bind needs local APIServiceExportTemplate and APIResourceSchema copies.

What this adds

Two new kcp-specific controllers (only active with --provider=kcp):

apibindingtemplate controller — watches APIBinding objects; when Bound, auto-creates APIServiceExportTemplate objects (one per scope) derived from the bound resources; binding is owner so templates GC on removal
apiresourceschema controller — watches APIServiceExportTemplate; copies APIResourceSchema definitions from the bound APIBinding into the backend workspace labeled kube-bind.io/exported=true for ServiceExportRequest discovery

Bootstrap also gains apibindings + subjectaccessreviews permission claims required by the new controllers.

Tests
kcp_3tier_test.go — two e2e tests covering cluster-scoped and namespaced resources through the full provider → backend → consumer chain.

What Type of PR Is This?

/kind feature

Related Issue(s)

Fixes #

Release Notes

kcp provider: add 3-tier topology support — backend can now serve resources from workspaces with only an APIBinding (no APIExport required). New apibindingtemplate and apiresourceschema controllers auto-populate templates and schema copies.

[mjudeikis]

Want to see what CI will tell for now

[mjudeikis]

@mjudeikis-bot review this please

[mjudeikis-bot]

Review submitted — see the PR review above. One potential blocker flagged (the getTemplateMapper type question); the rest are code-quality suggestions. Happy to re-review once those are addressed.

[mjudeikis]

@mjudeikis-bot, which of the code review questions are not yet addressed, as now it's a bit chaotic. Give clear bullet points and what needs to be changed and where.

[cnvergence]

Suggested change

	# unlreleased kcp version with vw code for schemas
	# unreleased kcp version with vw code for schemas

[cnvergence]

trailing ws

[cnvergence]

nit: 8.