Expose workloadCapabilities in NetworkSettings status

[ethanlynn-bc]

Background

Downstream consumers such as Virtual Kubernetes Service (VKS), PodVMs, and Virtual Machines need to determine the effective IP stack capabilities (IPv4, IPv6, DualStack) of a namespace upfront. Due to architectural boundaries and network isolation, guest and downstream components cannot directly query NSX EAS APIs (such as VPCIPAddressUsage). Attempting to provision unsupported IP families results in late-stage failures during subnet allocation.

Changes

This change exposes the computed IP capability summary in NetworkSettings:

• Enable status subresource for NetworkSettings (+kubebuilder:subresource:status).
• Add NetworkSettingsStatus and WorkloadCapability types to represent supported and default IP families, workload types, and status messages per workload.
• Add CEL validation ensuring supportedIPFamilies only contains 'IPv4', 'IPv6', or 'DualStack'.
• Define workload type constants (vksCluster, podVM, virtualMachine) and IP family constants (IPv4, IPv6, DualStack).
• Add CEL/schema unit tests in test/cel/networksettings_test.go covering admission of valid VPC/VDS/NSX-T1 capability matrices, single-family options, invalid IP family rejection, and duplicate workload types.

Testing Done

• go build ./... and go vet ./... clean for the module and test/cel
• make lint and make test passed