feat: filter scheduled scans by labels

[MaxRink]

Summary

• add spec.filtering.namespaceLabelSelector and spec.filtering.objectLabelSelector for scheduled Kubernetes resource scans
• pass selectors into generated cnspec inventories as namespace-label-selector and object-label-selector only when configured
• support the same selector options on external cluster filtering
• update CRD/deepcopy output, samples, docs, and focused inventory tests

Dependency

• Requires k8s provider support from ⭐ k8s: filter discovery by label selectors mql#8448 before users set these fields with cnspec images that include the new flags.

Tests

• make generate manifests
• go test ./controllers/k8s_scan ./api/v1alpha2 -count=1
• go test ./controllers/... -count=1
• git -c core.fsmonitor=false diff --check

[github-actions]

All contributors have signed the CLA ✍️ ✅
_{Posted by the CLA Assistant Lite bot.}

[MaxRink]

I have read the Mondoo CLA Document and I hereby sign the CLA

[mondoo-code-review]

Adds label selector filtering for scheduled Kubernetes scans, allowing users to filter namespaces and objects by labels.

[mondoo-code-review]

Adds label selector filtering for scheduled Kubernetes scans, allowing users to target namespaces and objects by labels.

[mondoo-code-review]

Adds label selector filtering for scheduled Kubernetes scans, allowing users to target namespaces and objects by labels.

[MaxRink]

/review

[MaxRink]

recheck

[github-actions]

Test Results

0 tests  ±0   0 ✅ ±0   0s ⏱️ ±0s
0 suites ±0   0 💤 ±0 
0 files   ±0   0 ❌ ±0 

Results for commit 0b16a53. ± Comparison against base commit 70733ca.

♻️ This comment has been updated with latest results.

[mondoo-code-review]

Adds label-based namespace and object filtering for scheduled Kubernetes scans via new CRD fields.

[mondoo-code-review]

CI-only change downgrades spell-check action from v0.0.26 to v0.0.25; no functional code impact.

[mondoo-code-review]

CI config updates: spell-check action restored to v0.0.26 and link-check now treats HTTP 403 as alive.

[mondoo-code-review]

Invalid label selectors are now surfaced as degraded status conditions, improving operator observability.