Extend NamespaceNetworkConfiguration to support VPC

[ihgann]

Adds VPCConfig as the second provider-specific config block alongside
VSphereDistributedConfig. VPC networking is activated by setting
spec.type to "vpc" and populating spec.vpcConfig.

VPCConfig supports two mutually exclusive VPC provisioning modes,
enforced by CEL mutual-exclusion guards on the type:

• vpc: associates a pre-existing NSX VPC by its Manager API path.
• managedVPCConfig: directs Net Operator to auto-provision a new VPC.

ManagedVPCConfig.project and ManagedVPCConfig.connectivityProfile
correspond to nsxProject and vpcConnectivityProfile in the nsx-operator
VPCNetworkConfiguration CRD [1]. Both fields are required when
managedVPCConfig is set; since all fields carry omitempty (KAL
convention), enforcement is via CEL rules on the type itself rather
than the OpenAPI required array — an absent field is seen as "" in CEL,
so self.project != '' catches the omitted case.

Both modes additionally accept:

• sharedSubnets: list-map of pre-existing NSX Subnets (keyed by path)
  to inject into each associated Namespace, with optional podDefault
  and vmDefault markers to designate workload-class defaults.
  VPCSharedSubnet.name is immutable once set (CEL oldSelf guard).
• defaultSubnetSize: number of IP addresses for auto-created subnets
  (maximum 65536, consistent with VPCNetworkConfiguration upstream [1]).

The temporary CEL restriction that limited spec.type to
"vsphere-distributed" is removed. A parallel CEL guard is added for
vpc: self.type == 'vpc' ? has(self.vpcConfig) : true.

All new types conform to kube-api-linter without suppressions or
exclusions. VPCConfig is embedded as *VPCConfig (pointer) because all
its fields are optional, meaning the zero value {} is only ruled out by
CEL, not by schema alone; the pointer satisfies KAL's optionalfields
linter which requires a pointer when schema validation is incomplete.

[1] https://github.com/vmware-tanzu/nsx-operator/blob/main/pkg/apis/vpc/v1alpha1/vpcnetworkconfiguration_types.go

---

Testing Done:

• CEL testing completed - verification of installation of CRD for type VPC. Sample script referenced: TODO.