api/avic: add certificateAuthorityData, CEL validation rules, and envtest suite

[wfangchi]

Summary

This PR introduces the certificateAuthorityData field to AviLoadBalancerConfigSpec along with admission-time validation markers and an envtest CEL test suite for AviLoadBalancerConfig.

API changes

AviLoadBalancerConfigSpec

• certificateAuthorityData (new field) — Added optional string field (json:"certificateAuthorityData,omitempty") containing PEM-encoded CA certificates used to verify the Avi Controller's TLS certificate.
  • Enables synchronous certificate format validation in downstream validating webhooks (net-operator) on both Create and Update operations without depending on external Secret lifecycles or ordering guarantees.
  • Serves as public identity material directly visible in the CR.
  • Maintains backward compatibility: when omitted or empty, downstream controllers and services fall back to the CA certificate stored in the Secret referenced by credentialSecretRef.
• cloudName — Added +kubebuilder:validation:MinLength=1 constraint to reject explicitly-empty strings while preserving the Default-Cloud default when omitted or zero-valued via typed Go clients (omitempty).
• server — Intentionally left without MinLength=1 to ensure backward compatibility with existing running configurations; runtime validation remains guarded by controller and VAPI layers.

ClientSecretReference

• name — Added canonical Kubernetes DNS-1123 subdomain validation markers (+kubebuilder:validation:MinLength=1, MaxLength=253, and Pattern=^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$). Ensures secret references conform to standard Kubernetes resource naming requirements.

Tests

• 7 envtest integration test cases added in test/cel/aviloadbalancerconfig_test.go covering all validation rules and defaulting behavior:
  • Valid AviLoadBalancerConfig admission.
  • Admission of empty spec.server (backward-compatibility preservation).
  • spec.cloudName defaulting to "Default-Cloud" when omitted or zero-valued via typed Go client (omitempty behavior).
  • spec.cloudName rejection by MinLength=1 when sent explicitly as "" via unstructured JSON payload.
  • Admission of valid DNS-1123 dot-separated spec.credentialSecretRef.name (e.g. avi.creds.v1).
  • Table-driven rejection of invalid spec.credentialSecretRef.name patterns (uppercase characters, leading/trailing hyphens, consecutive dots, and empty strings).
• make generate — clean regeneration of deepcopy and CRD YAML manifests.
• make test-unit & make test-cel — all unit tests and CEL integration tests passing.