fix: update CEL validation for expireAfter and consolidateAfter fields to block invalid values like 1hr

[saurav-agarwalla]

Fixes #N/A

Description
Current CEL validation allows values like 1hr to be set in the spec which causes the resources to be stuck in a weird state.

How was this change tested?

Used this spec for nodepool:

apiVersion: karpenter.sh/v1
kind: NodePool
metadata:
  name: malformed
spec:
  disruption:
    budgets:
    - nodes: 10%
    consolidateAfter: 1hr
    consolidationPolicy: WhenEmpty
  template:
    spec:
      expireAfter: 12h
      nodeClassRef:
        group: karpenter.k8s.aws
        kind: EC2NodeClass
        name: default
      requirements:
      - key: karpenter.sh/capacity-type
        operator: In
        values:
        - on-demand
      terminationGracePeriod: 24h0m0s

Before the change:

~ k apply -f malformed-nodepool.yaml
nodepool.karpenter.sh/malformed created

~ k get nodepool
NAME        NODECLASS   NODES   READY   AGE
default     default     0       True    8d
malformed   default                     89s

In the logs:

{"level":"INFO","time":"2025-03-06T18:14:19.413Z","logger":"controller","caller":"cache/reflector.go:370","message":"k8s.io/[email protected]/tools/cache/reflector.go:251: failed to list *v1.NodePool: time: unknown unit \"hr\" in duration \"1hr\"","commit":"974a323-dirty"}

After the change:

 ~ k apply -f malformed-nodepool.yaml
The NodePool "malformed" is invalid: spec.disruption.consolidateAfter: Invalid value: "1hr": spec.disruption.consolidateAfter in body should match '^(([0-9]+(s|m|h))+|Never)$'

I can't replicate this in the unit tests since the tests parse the duration so testing that kind of makes it pointless since what we really want to test is CEL server-side validation catching it like it did above. I've added other unit tests to ensure that there's no regression.

Regex testing:

Before: https://regex101.com/r/C8F0Wf/1
After: https://regex101.com/r/nHnhl2/1

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.

[coveralls]

Pull Request Test Coverage Report for Build 13712102484

Details

• 0 of 0 changed or added relevant lines in 0 files are covered.
• 2 unchanged lines in 1 file lost coverage.
• Overall coverage remained the same at 81.616%

---

Files with Coverage Reduction	New Missed Lines	%
pkg/test/expectations/expectations.go	2	95.0%

Totals
Change from base Build 13683176482:	0.0%
Covered Lines:	9594
Relevant Lines:	11755

---

💛 - Coveralls

[jonathan-innis]

/lgtm
/approve

[k8s-ci-robot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: jonathan-innis, saurav-agarwalla

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [jonathan-innis]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment