Feature: Report an error if a namespace is set on non-namespaceable resource

[lblackstone]

Overly broad transformations can erroneously set the namespace for non-namespaceable resource Kinds. While this doesn't prevent the resource from being created, it can force an unnecessary replacement if this ignored field is changed later.

It would be better to catch this condition at the Check stage, and report an error rather than silently accepting an invalid configuration.

See related comment: #415 (comment)

[lblackstone]

The provider logic correctly handles these cases now [1] to prevent unnecessary resource replacement. All resources except CRs will be corrected during the Check phase based on authoritative information from the k8s API server. For CRs, the namespace can be set erroneously due to a lack of required information, but will be corrected during the Create phase if necessary. The combination of these steps will prevent erroneous replacements.

It may still be worth printing a warning message during Check for non-CR resources to avoid confusing the user, but it won't affect update functionality.

[1] #538

[hausdorff]

I think we should not do this for Q3, since this is a flaw the underlying k8s API has as well (i.e., k8s will happily accept resources with .metadata.namespace set, but which are not namespaced).

[lblackstone]

The provider handles this case gracefully, so nothing to do here.