fix(kuma-cp): kds sync on upgrade doubles the number of policies (backport of #9259)

[kumahq]

Automatic cherry-pick of #9259 for branch release-2.6

Generated by action

cherry-picked commit 6353c95
⚠️ ⚠️ ⚠️ Conflicts happened when cherry-picking! ⚠️ ⚠️ ⚠️

On branch release-2.6
Your branch is up to date with 'origin/release-2.6'.

You are currently cherry-picking commit 6353c954e.
  (fix conflicts and run "git cherry-pick --continue")
  (use "git cherry-pick --skip" to skip this patch)
  (use "git cherry-pick --abort" to cancel the cherry-pick operation)

Changes to be committed:
	modified:   pkg/api-server/api_server_suite_test.go
	modified:   pkg/api-server/circuit_breaker_endpoints_test.go
	modified:   pkg/api-server/fault_injection_endpoints_test.go
	modified:   pkg/api-server/global_secret_endpoints_test.go
	modified:   pkg/api-server/health_check_endpoints_test.go
	modified:   pkg/api-server/resource_endpoints.go
	modified:   pkg/api-server/resource_endpoints_test.go
	modified:   pkg/api-server/secret_endpoints_test.go
	new file:   pkg/api-server/testdata/resource_400onNoOriginLabel.golden.json
	modified:   pkg/api-server/traffic_route_endpoints_test.go
	modified:   pkg/api-server/traffic_trace_endpoints_test.go
	modified:   pkg/core/resources/model/resource.go
	modified:   pkg/kds/context/context.go
	modified:   pkg/plugins/runtime/k8s/plugin.go
	modified:   pkg/plugins/runtime/k8s/webhooks/defaulter.go
	modified:   pkg/plugins/runtime/k8s/webhooks/defaulter_test.go
	new file:   pkg/plugins/runtime/k8s/webhooks/resourceadmissionchecker.go
	modified:   pkg/plugins/runtime/k8s/webhooks/validation.go
	modified:   pkg/plugins/runtime/k8s/webhooks/validation_test.go

Unmerged paths:
  (use "git add/rm <file>..." as appropriate to mark resolution)
	deleted by us:   test/e2e/helm/kuma_helm_upgrade_multizone.go