feat: Add advanced authorization webhook for Kubernetes

[tolusha]

What does this PR do?

Adds a standalone ValidatingWebhookConfiguration that enforces advancedAuthorization policy on workspace namespace resources, enabling group-based authorization on Kubernetes (previously OpenShift-only).

Key changes:

• Register a new authorization webhook at /validate-advanced-authorization that intercepts ConfigMap creates in workspace namespaces using namespace and object label selectors
• Move webhook registration from SetupWebhookWithManager helper to explicit registration in main.go for all three webhooks (defaulter, validator, authorization)
• Refactor authorization package: use slices.Contains, improve variable naming
• Update CRD, deployment manifests, and webhook configurations
• Remove OpenShift-only note from AdvancedAuthorization API docs

Screenshot/screencast of this PR

N/A — backend/operator change.

What issues does this PR fix or reference?

eclipse-che/che#23778

How to test this PR?

1. Deploy the operator:

OpenShift

./build/scripts/olm/test-catalog-from-sources.sh

or

build/scripts/docker-run.sh /bin/bash -c "
  oc login \
    --token=<...> \
    --server=<...> \
    --insecure-skip-tls-verify=true && \
  build/scripts/olm/test-catalog-from-sources.sh
"

on Minikube

./build/scripts/minikube-tests/test-operator-from-sources.sh

2. Configure advancedAuthorization in the CheCluster CR with allowUsers/denyUsers/allowGroups/denyGroups
3. Verify that authorized users can access workspaces and denied users are rejected
4. Verify group-based authorization works on Kubernetes (not just OpenShift)

Common Test Scenarios

• Deploy Eclipse Che
• Start an empty workspace
• Open terminal and build/run an image
• Stop a workspace
• Check operator logs for reconciliation errors or infinite reconciliation loops

PR Checklist

As the author of this Pull Request I made sure that:

• The Eclipse Contributor Agreement is valid
• Code produced is complete
• Code builds without errors
• Tests are covering the bugfix
• The repository devfile is up to date and works
• Relevant user documentation updated
• Relevant contributing documentation updated
• CI/CD changes implemented, documented and communicated

Reviewers

Reviewers, please comment how you tested the PR when approving it.

[openshift-ci]

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

[openshift-ci]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: tolusha

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[tolusha]

Hi! I'm che-ai-assistant — I help with your pull requests.

I check for new comments every 10m0s, so there may be a short delay before I respond.

Available commands:

• /che-ai-assistant generate-che-doc — Generate a documentation PR based on this PR's changes
• /che-ai-assistant ok-pr-review — Run a comprehensive PR review (summary, code review, deep review, impact analysis)
• /che-ai-assistant ok-pr-readiness — Ensure PR has validation steps
• /che-ai-assistant check-pr-test-failures — Analyze failing CI checks, identify root causes, and suggest fixes
• /che-ai-assistant update-che-e2e-tests — Update Eclipse Che e2e tests
• /che-ai-assistant claude — Run a free-form instruction on this PR
• /che-ai-assistant help — Show this help message

[tolusha]

⚠️ Warning: IDE/tool configuration files detected

This PR contains changes to files in directories that are typically not intended to be committed:

• .claude/rules/code-style.md

Please verify these changes are intentional.