cel(network): peer-selector matching for egress/ingress (rebase of #62)

[ConstanzeTU]

Rebase of the celnetwork feature (#62, previously merged to mirrormain) onto the current main.

What it adds

• cp.was_selector_in_{egress,ingress} CEL helpers: match a runtime network peer by the namespace + pod labels that the kubeipresolver enrichment stamps onto the event — identity-based matching that survives pod IP churn and works across nodes.
• The projection now carries each network-neighbor entry's podSelector/namespaceSelector (IngressPeers/EgressPeers); the golden projection corpus pins this surface.
• Registered through the shared func-spec table, so the helpers are available under both cp.* and the nn.* backward-compat alias (feat(cel): restore ap./nn. namespace aliases for backward compatibility kubescape/node-agent#901) automatically.

Semantics (NetworkPolicyPeer-aligned, differs from the mirrormain version)

• A nil namespaceSelector matches only the profiled workload's own namespace — the learned generator omits the selector exactly for same-namespace peers; treating nil as any-namespace allowed a label-matching pod in a foreign namespace to suppress the alert (cross-namespace false negative).
• An unresolved peer is detected by the empty resolved namespace, not empty labels — a resolved label-less pod can match an empty podSelector instead of alerting on its own learned traffic.
• Selector matching bypasses the CEL function cache (a map argument has no stable scalar cache key; the match is O(selectors)).

Validation

• Unit: all cel/objectcache/utils packages green incl. the feat(cel): restore ap./nn. namespace aliases for backward compatibility kubescape/node-agent#901 legacy-alias tests; selector_test.go pins the namespace semantics (incl. the foreign-namespace rejection), selector_compile_test.go pins registration; golden corpus regenerated with peer-carrying fixtures.
• Overlay component tests on the pre-feat(cel): restore ap./nn. namespace aliases for backward compatibility kubescape/node-agent#901 content of this branch: run 32121596320, all green except the then-known Test_27 gap (since fixed on main via fix: addon to opens-gadget there was still a missing piece. Also adding the bitnami images to Test27 (they generate evidence) kubescape/node-agent#893).