Enforce access checks for brokers in the k8s workloadattestor

[matheuscscp]

Preview for spiffe#7074

SPIRE PR: spiffe#6915

Adds broker-aware Kubernetes authorization checks to the k8s workload attestor. Broker-originated Attest() / AttestReference() calls that reference Kubernetes objects now run a Kubernetes SubjectAccessReview before returning selectors. The SAR uses the broker SPIFFE ID as the username and no groups, and asks whether that user may use SPIRE's custom verb impersonate-via-spire on the referenced object.

For pod references, brokers can also set pod_reference_scope. The default agent_node scope only allows pods whose spec.nodeName matches the configured agent node name (node_name / node_name_env); cluster removes that same-node restriction, but the SubjectAccessReview check still applies.

WorkloadAttestor "k8s" {
  plugin_data {
    node_name_env = "MY_NODE_NAME"

    broker {
      brokers = [
        {
          id = "spiffe://example.org/broker"
          pod_reference_scope = "cluster"
        },
      ]
    }
  }
}

[matheuscscp]

Merged it to the main SPIRE PR.