Fix control plane access for private endpoints

[AnouarMohamed]

Summary

• skip master authorized network checks when the cluster has no public control plane endpoint
• support both legacy private endpoint config and the newer control plane endpoint config shape
• add v1/v2 regression tests for private-only, disabled IP endpoint, and nested authorized-network configs

Root cause

The policy always required master authorized network CIDRs, even when the public control plane endpoint was disabled. Authorized networks constrain public endpoint access, so private-only clusters were reported invalid incorrectly.

Validation

• /tmp/opa test gke-policies -v
• /tmp/opa test gke-policies-v2 -v
• /tmp/regal lint --format github gke-policies-v2
• go test ./...

Closes #227

[mikouaj]

LGTM