feat: Introduce ContactGroupEnrollmentPolicy and controller to automate contact group memberships.

[JoseSzycho]

Pull Request: Implement ContactGroupEnrollmentPolicy and Controller

Title

feat(notification): implement ContactGroupEnrollmentPolicy and controller for automated memberships

Description

This PR introduces the ContactGroupEnrollmentPolicy API and its corresponding controller to automate the enrollment of newly created contacts into designated contact groups. It also includes comprehensive E2E integration tests, API registration, and auto-generated manifests.

Key Changes

1. API Definition (ContactGroupEnrollmentPolicy)

• Introduced a new cluster-scoped CRD: ContactGroupEnrollmentPolicy (notification.miloapis.com/v1alpha1).
• Spec details:
  • contactGroupRef: Specifies the target group (name and namespace) for enrollment.
  • trigger: Defines when enrollment happens (e.g. type: ContactCreated).
  • contactSelector (optional): Enables filtering by SubjectKind (e.g. User).
• Generated Deepcopy and CRD manifests.

2. Reconciler (ContactGroupEnrollmentController)

• Watches Contact and ContactGroupEnrollmentPolicy resources.
• Automatically creates ContactGroupMembership records for matching policies when a contact is created.
• Opt-Out Handling: Inspects existing ContactGroupMembershipRemoval records and skips enrollment for opted-out contacts.
• Idempotency: Annotates processed contacts with evaluated policies using enrollment.notification.miloapis.com/{policyName} = true to avoid duplicate reconciliations.
• Webhook Handling: Gracefully handles and skips non-retryable admission webhook rejections (e.g. duplicate memberships or opt-out collisions).
• Efficiency: Configures a field indexer on ContactGroupMembershipRemoval by spec.contactRef.name for fast lookup.

3. Controller Manager Integration

• Registered the controller within cmd/milo/controller-manager/controllermanager.go.
• Generated RBAC permissions required for managing contacts, contactgroupenrollmentpolicies, contactgroupmemberships, and contactgroupmembershipremovals.

4. End-to-End Tests

• Added a robust suite of chainsaw integration tests under test/notification/contact-group-enrollment/ covering:
  1. Enrollment of Contacts with User subject references.
  2. Exclusion of Contacts not matching the selector (e.g. bare contacts).
  3. Honoring pre-existing opt-out removal records.
  4. Idempotency validation (duplicate runs do not cause duplicates).
  5. Retroactive enrollment of existing Contacts when a new policy is created.
  6. End-to-end flow from User registration to Contact creation and ContactGroupMembership enrollment.

Verification Results

All E2E tests have passed successfully:

--- PASS: chainsaw (25.51s)
    --- PASS: chainsaw/contact-group-enrollment (13.48s)