feat: Implement CEL runtime cost budget for expression evaluation

[Rudra-Sankha-Sinhamahapatra]

PR Description

Fixes #191

Feature Description

This PR implements cost budgeting for CEL expression evaluation to prevent resource exhaustion from complex expressions. The controller now enforces both per-call limits for individual expressions and a total runtime budget for the entire reconciliation cycle.

Key features implemented:

• Per-call cost limit (1,000,000 units, ~0.1 second of execution time)
• Total runtime budget (1,000 units for all expressions in a reconciliation cycle)
• Budget exceeded error handling and proper status reporting

Implementation Details

• Added cost tracking constants and helper functions in pkg/cel/cost.go
• Implemented cost accumulation in ResourceGraphDefinitionRuntime
• Added error handling for budget exceeded cases in controller
• Updated expression evaluation to use cost tracking options

Testing

• Added tests for CEL cost budget enforcement
• Verified error handling when budget is exceeded
• Added test cases with both simple and complex expressions

pkg/cel Tests

pkg/graph Tests

pkg/runtime Tests

All tests

Example Error

When the CEL budget is exceeded, the controller will report an error and the instance status will reflect:

apiVersion: kro.run/v1alpha1
kind: ResourceGroup
metadata:
  name: my-application
status:
  conditions:
    - type: Ready
      status: "False"
      reason: CELBudgetExceeded
      message: "Total CEL cost exceeded budget of 1000"

This prevents potential DoS attacks from overly complex expressions and ensures the controller remains responsive.

cc: @a-hilaly