Add k8s.authCanI operation for checking RBAC permissions

[Cali0707]

Description

Add a k8s.authCanI operation to check RBAC permissions for users and service accounts. This is essential for verifying RBAC configuration in tasks like create-simple-rbac, fix-rbac-wrong-resource, and setup-dev-cluster.

Current bash tasks use patterns like:

• kubectl auth can-i get pods --as=system:serviceaccount:ns:sa -n namespace
• kubectl auth can-i create pods --as=user -n namespace
• kubectl auth can-i list pods --as=user -A (cluster-wide check)

Requirements

• Support checking permissions for a specific verb and resource
• Support impersonation via --as (user or service account)
• Support namespace-scoped and cluster-wide checks
• Support an expect block for inline verification of allowed/denied

Example Usage

- k8s.authCanI:
    verb: get
    resource: pods
    as: system:serviceaccount:create-simple-rbac:reader-sa
    namespace: create-simple-rbac
    expect:
      allowed: true

- k8s.authCanI:
    verb: delete
    resource: pods
    as: system:serviceaccount:create-simple-rbac:reader-sa
    namespace: create-simple-rbac
    expect:
      allowed: false

Acceptance Criteria

• Can check if a verb (get, list, create, delete, etc.) is allowed on a resource
• Can impersonate users (e.g., alice)
• Can impersonate service accounts (e.g., system:serviceaccount:ns:sa-name)
• Can scope check to a specific namespace
• Can perform cluster-wide permission checks
• Supports expect.allowed for inline verification
• Operation is documented in extension manifest