[FEAT repo-guard] - Add kubebuilder validation markers to all CRD types

[onuryilmaz]

User Story

As a platform operator, I want invalid CRD resources to be rejected at apply time by kubectl, so that misconfigured resources never reach the controller.

Description

Currently none of the repo-guard CRD types (GithubOrganization, GithubTeam, GithubTeamRepository, Github, LDAPGroupProvider, GenericExternalMemberProvider, etc.) have +kubebuilder validation markers. There is no admission webhook in place either. As a result, resources with empty required fields, invalid permission values, or malformed URLs are admitted silently and only fail during reconciliation with hard-to-debug errors.

Adding +kubebuilder markers to the _types.go files causes make manifests to embed OpenAPI validation into the generated CRD schemas, enabling client-side validation via kubectl and server-side validation via the Kubernetes API server — no webhook required.

This is tracked as Pillar 3 of epic #95. This issue covers the marker additions only.

Acceptance Criteria

• +kubebuilder:validation:MinLength=1 added to all required string fields (spec.github, spec.organization, spec.team, etc.)
• +kubebuilder:validation:Minimum=1 added to spec.installationID on GithubOrganization
• +kubebuilder:validation:Enum=admin;push;pull;maintain;triage added to all permission fields
• +kubebuilder:validation:Pattern=^https?:// added to URL fields on Github and GenericExternalMemberProvider
• spec.organization immutability enforced via +kubebuilder:validation:XValidation CEL oldSelf rule
• make manifests regenerates CRDs cleanly with new constraints
• Existing valid resources are unaffected (no breaking changes)

Reference Issues

Epic: #95

[github-actions]

Thanks for opening this issue! 🎉

A maintainer will triage it within 5 business days. You can learn more about our issue workflow in the Issue Lifecycle documentation.

In the meantime, please make sure you have provided:

• A clear problem statement
• Steps to reproduce (for bugs)
• Expected vs actual behavior

This helps us route your issue faster.