feat(plugins) allow cross-namespace plugin references

[rainest]

What this PR does / why we need it:

Add a new colon-delimited value format for the konghq.com/plugins CSV annotation. The string before the colon indicates a remote KongPlugin namespace. This namespace must contain a ReferenceGrant that allows this reference.

While the existing konghq.com/plugins: foo,bar format loads plugins foo and bar from the same namespace as the annotated resource, the new konghq.com/plugins: foo,alpha:bar format loads foo from the local namespace and bar from the alpha namespace.

example_cross_plugin.yaml.txt provides a more complete example. Service one in namespace pwuh loads the test KongPlugin from the pwuh namespace as usual. Service two in namespace fwuh loads the same test KongPlugin from pwuh. It can do so because a ReferenceGrant in pwuh grants KongPlugin access to fwuh Services.

Which issue this PR fixes:

Fix #5355. Although the original request concerned KongClusterPlugins, using KongPlugins allows for a simpler security configuration model.

Review #5355 (comment) for additional background on why multi-entity plugins require grants to adhere to the Kubernetes namespace security model.

Special notes for your reviewer:

There was already a fair amount of code duplication in the plugin relationship builder. Ideally we'd do away with it, but I've left it around for the time being. The isRemotePluginReferenceAllowed() helper hopefully negates the worst of it by extracting most of the logic we need to duplicate into a separate function, so the duplicated code is just the function invocation.

PR Readiness Checklist:

Complete these before marking the PR as ready to review:

• the CHANGELOG.md release notes have been updated to reflect any significant (and particularly user-facing) changes introduced by this PR

[codecov]

Codecov Report

Attention: Patch coverage is 53.64238% with 70 lines in your changes are missing coverage. Please review.

Project coverage is 52.2%. Comparing base (d8c30ad) to head (bc9431b).
Report is 3 commits behind head on main.

❗ Current head bc9431b differs from pull request most recent head d779068. Consider uploading reports for the commit d779068 to get more accurate results

Files	Patch %	Lines
internal/gatewayapi/references.go	39.3%	35 Missing and 2 partials ⚠️
internal/dataplane/kongstate/kongstate.go	53.5%	32 Missing and 1 partial ⚠️

Additional details and impacted files

@@           Coverage Diff            @@
##            main   #5965      +/-   ##
========================================
- Coverage   74.0%   52.2%   -21.8%     
========================================
  Files        182     182              
  Lines      18345   18416      +71     
========================================
- Hits       13582    9624    -3958     
- Misses      3825    8164    +4339     
+ Partials     938     628     -310     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

[pmalek]

Can we add an exemplar manifest for this functionality in examples/?

[rainest]

Some sort of nonsense apparently means the test... passes? but then leaves some of its resources around, furthermore preventing the test suite from finishing :(

Ed: I am an idiot and committed the thing I did to stall another test to play around with integration test design 🤦

[randmonkey]

Mostly LGTM, some minor comments remaining.