implement CEL runtime cost budget in controller

[a-hilaly]

Feature Description

Currently kro doesn't enforce any limits on CEL expression evaluation costs. We need to implement cost budgeting similar to Kubernetes API server to prevent resource exhaustion from complex expressions. The controller should enforce both per call and total runtime budgets.

Example constants, inspired from https://github.com/kubernetes/apiserver/blob/2241ea00526fdd746871375dfca871627f6a511a/pkg/apis/cel/config.go#L1

const (
    // PerCallLimit specifies the cost limit per individual CEL expression evaluation
    // This gives roughly 0.1 second of execution time per expression evaluation
    PerCallLimit = 1000000

    // RuntimeCELCostBudget is the total cost budget allowed during a single 
    // ResourceGroup reconciliation cycle. This includes all expression evaluations
    // across all resources defined in the ResourceGroup. The budget gives roughly
    // 1 second of total execution time before being exceeded.
    RuntimeCELCostBudget = 10000000

    // CheckFrequency configures the number of iterations within a comprehension to evaluate
    // before checking whether the function evaluation has been interrupted
    CheckFrequency = 100
)

Example error when budget is exceeded:

apiVersion: kro.run/v1alpha1
kind: ResourceGroup
metadata:
  name: my-application
status:
  conditions:
    - type: Ready
      status: "False"
      reason: CELBudgetExceeded
      message: "Total CEL cost 12M exceeded budget of 10M"