vmauth: introduce arbitrary fs access

[AndrewChubatiuk]

fixes #899

---

Summary by cubic

Adds arbitraryFSAccessThroughSMs to VMAuth to allow or block file-path references in VMUser configs. When denied, VMAuth rejects users that reference node files (e.g., bearer tokens, basic auth, TLS files).

• New Features
  • Added arbitraryFSAccessThroughSMs.deny to VMAuthSpec; when true, VMUser.ValidateArbitraryFSAccess() blocks configs with file-path refs (e.g., TLS cert/key/CA).
  • Updated CRDs, deepcopy, and docs (API includes VMAuthSpec; CHANGELOG entry added).

^{Written for commit 363c0be. Summary will update on new commits.}

[cubic-dev-ai]

2 issues found across 9 files

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="docs/CHANGELOG.md">

<violation number="1" location="docs/CHANGELOG.md:16">
P2: Custom agent: **Changelog Review Agent**

Changelog entry is missing the mandatory user-centric before/now/user-visible impact explanation.</violation>
</file>

<file name="internal/controller/operator/factory/vmauth/vmusers_config.go">

<violation number="1" location="internal/controller/operator/factory/vmauth/vmusers_config.go:126">
P1: `arbitraryFSAccessThroughSMs.deny` is enforced only for VMUser entries, so `unauthorizedUserAccessSpec` can still inject file-based TLS paths and bypass the deny policy.</violation>
</file>

_{Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review, or fix all with cubic.}