Watch authz ConfigMaps from VirtualMCPServer

[blkt]

The VirtualMCPServer controller did not watch ConfigMaps referenced by spec.incomingAuth.authzConfig.configMap, so changes to a referenced authz ConfigMap were never observed: the converter was not re-run, the rendered vmcp config.yaml retained stale policies, and the running pod enforced them indefinitely. This matters in particular for the enterprise flow where an external controller rewrites the authz ConfigMap when Cedar policies change.

Add a Watches entry on corev1.ConfigMap with:

• a mapper that lists VirtualMCPServers in the ConfigMap's namespace and enqueues those whose AuthzConfig.Type is "configMap" and whose ConfigMap.Name matches the changed object
• a predicate that admits Create and Delete events unconditionally and Update events only when .Data or .BinaryData actually changed, so metadata-only updates (labels, annotations, resourceVersion bumps) do not trigger reconciliation

The watch is functionally meaningful only once #5208 lands and the converter actually resolves ConfigMap-sourced policies; until then the re-reconcile still produces an empty-policy config. Wiring it now unblocks that follow-up without an extra round trip.

Closes #5270

[codecov]

Codecov Report

❌ Patch coverage is 77.77778% with 10 lines in your changes missing coverage. Please review.
✅ Project coverage is 68.28%. Comparing base (3dfed71) to head (98ee559).

Files with missing lines	Patch %	Lines
...or/controllers/virtualmcpserver_authz_configmap.go	87.50%	3 Missing and 2 partials ⚠️
...perator/controllers/virtualmcpserver_controller.go	0.00%	5 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #5271      +/-   ##
==========================================
- Coverage   68.32%   68.28%   -0.05%     
==========================================
  Files         618      619       +1     
  Lines       63274    63319      +45     
==========================================
+ Hits        43235    43236       +1     
- Misses      16807    16851      +44     
  Partials     3232     3232              

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[jhrozek]

that comment was meant to be a follow-up suggestion, not a blocker