feat: add namespace-scoped silence enforcement (v1alpha2)

[splattner]

What

Adds a selector-gated, off-by-default multi-tenancy control for the
observability.giantswarm.io/v1alpha2 API. When one or more rules are configured,
a Silence created in a namespace matching a rule's namespaceSelector gets an
authoritative namespace="<namespace>" matcher (plus any custom matchers from the
rule) injected into the Alertmanager silence — so a silence can only ever mute
alerts belonging to its own namespace.

Why

By default a Silence in one namespace can mute alerts from any namespace, since
a silence is just a set of Alertmanager matchers. This provides lightweight
namespace isolation for shared-Alertmanager, multi-tenant setups.

How it works

• Configured via a mounted YAML file (--namespace-enforcement-config), rendered by
  Helm from namespaceEnforcement values into a ConfigMap.
• Rules use native metav1.LabelSelector. A namespace is enforced if it matches
  any rule (OR). Empty rules ⇒ no enforcement (the default).
• Rules are first-match-wins (top-to-bottom); the first matching rule's custom
  matchers apply.
• Enforcement is authoritative: a user-supplied matcher on an enforced label is
  overridden, logged, and surfaced as a MatcherOverridden Kubernetes Event on the
  Silence.
• Evaluated at reconcile time and fail-closed — if the namespace lookup fails,
  the silence is not synced.

Example

namespaceEnforcement:
  matcherLabel: "namespace"
  rules:
    - namespaceSelector:
        matchLabels:
          tenant-isolation: "enabled"
    - namespaceSelector:
        matchExpressions:
          - key: team
            operator: In
            values: [platform]
      matchers:
        - name: cluster_id
          value: prod
          matchType: "="