bug: CEL validation of PermissionClaims.ResourceSelector.Namespaces not compiling or passing tests

[nrb]

Describe the bug

As part of #2456, a CEL validation rule was added to the PermissionClaims.ResourceSelector.Namespaces field to disallow the empty string ("") anywhere in the list.

However, this test is not passing and the validator function created from the rule seems to be a no-op based on debugging information.

Steps To Reproduce

1. Edit pkg/apis/apis/v1alpha1/types_apiexport_test.go and remove the t.Skip statement
2. cd pkg/apis && go test ./apis/v1alpha1 -run TestAPIExportPermissionClaimNamespace

--- FAIL: TestAPIExportPermissionClaimNamespace (0.00s)
    --- FAIL: TestAPIExportPermissionClaimNamespace/single_invalid_entry (0.00s)
        types_apiexport_test.go:279: want error "\"\" is not a valid namespace. Leave field blank for cluster-scoped resources", got ""
FAIL
FAIL    github.com/kcp-dev/kcp/pkg/apis/apis/v1alpha1   0.298s
FAIL

Expected Behaviour

The CEL validation function should be constructed, but for some reason stepping into it all the fields are set to nil. Possibly a bug in our parsing logic?

Additional Context

No response

[kcp-ci-bot]

Issues go stale after 90d of inactivity.
After a furter 30 days, they will turn rotten.
Mark the issue as fresh with /remove-lifecycle stale.

If this issue is safe to close now please do so with /close.

/lifecycle stale

[kcp-ci-bot]

Stale issues rot after 30d of inactivity.
Mark the issue as fresh with /remove-lifecycle rotten.
Rotten issues close after an additional 30d of inactivity.

If this issue is safe to close now please do so with /close.

/lifecycle rotten