CEL lib: Expose errors on authz decisions instead of raising them from check()

[benluddy]

What type of PR is this?

/kind feature

What this PR does / why we need it:

Revival of #116491

Which issue(s) this PR fixes:

#116261 (comment)

Special notes for your reviewer:

Does this PR introduce a user-facing change?

CEL authorizer checks no longer raise runtime errors. Calls to "check" will always return a decision object and the authorization error (if any) can be accessed within expressions using the new decision methods "errored" and "error".

Additional documentation e.g., KEPs (Kubernetes Enhancement Proposals), usage docs, etc.:

/sig api-machinery

[benluddy]

/cc @jpbetz

I made two significant changes from the original:

• The error message itself is exposed via a second method instead of through reason().
• The return value of allowed() doesn't vary based on the presence of an error.

[jiahuif]

/assign
/triage accepted

[jpbetz]

/approve

[k8s-ci-robot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: benluddy, jpbetz

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• staging/src/k8s.io/apiserver/pkg/admission/plugin/cel/OWNERS [jpbetz]
• staging/src/k8s.io/apiserver/pkg/cel/OWNERS [jpbetz]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[jpbetz]

@jiahuif would you do a review pass? At a glance this LGTM to me, when you're happy with it we can merge.

[cici37]

/lgtm
Thank you!

[k8s-ci-robot]

LGTM label has been added.

Git tree hash: ba190c791a50feed7bffa54627fb4e98bde77296

[jiahuif]

/lgtm

side note: in the future we might want to export the error type to cel, to avoid errored = err != nil and error() = err.Error()

[benluddy]

in the future we might want to export the error type to cel, to avoid errored = err != nil and error() = err.Error()

CEL Optional types could be appropriate for this sort of thing, too.