ReferenceGrant Core Support

[mpstefan]

For our release of NGINX Gateway v1.0, we need at least core support for the ReferenceGrant API Object as defined in the Kubernetes Gateway API v1beta1. We may want to split this by kinds, but we will also need acceptance criteria to ensure access is updated when the ReferenceGrants are changed in any way.

The API specificiation for ReferenceGrantSpec states that a reference grant is made from a ReferenceGrantFrom to a ReferenceGrantTo, each specifies a different set of objects to target:

ReferenceGrantFrom kinds:

• If "ReferenceGrantTo" is a SecretObjectReference: Gateway
• If "ReferenceGrantTo" is a BackendObjectReference: GRPCRoute, HTTPRoute, TCPRoute, TLSRoute, UDPRoute

ReferenceGrantTo kinds:

• SecretObjectReference (Secret)
• BackendObjectReference (Service)

Each one of the RerferenceGrantFrom kinds needs to be able to target any one of the ReferenceGrantTo kinds.

Acceptance:

• The ReferenceGrant should permit Gateways or Routes to reference Secrets or Services across namespace boundaries.
• Cross-namespace references without a grant should not be permitted.
• When a ReferenceGrant is changed or removed, the access that the grant allowed should be automatically recalculated and applied accordingly.
• If a cross-namespace reference is made without an applicable ReferenceGrant, do NOT expose information about the existence of a resource in another namespace. NKG should only report that the ReferenceGrant does not exist to allow this reference. Do not give hints about whether or not the referenced resource exists.
• Update the documentation
  • Update the compatibility doc
  • Add an example for both Gateway -> Secret and Route -> Backend cross-namespace routing

### Stories
- [ ] https://github.com/nginxinc/nginx-kubernetes-gateway/issues/694
- [ ] https://github.com/nginxinc/nginx-kubernetes-gateway/issues/695
- [ ] https://github.com/nginxinc/nginx-kubernetes-gateway/issues/687

For Discussion:

• ReferenceGrantFrom includes core support for GRPCRoute, TCPRoute, TLSRoute, and UDPRoute - how does this make sense when those routes are not included in the v1beta1 spec?
• Does the above split for stories make sense?