feat(test): Add static policy analysis tool for network policy validation

[electricjesus]

Description

This PR adds a static analysis tool that validates network policy selectors match actual pod labels. This helps catch bugs like the PrometheusSelector issue (PR #4410) where policy selectors didn't match actual pod labels.

Type: New feature (test infrastructure)

Why this should be merged:

• Catches selector/label mismatches that could block traffic in production
• Runs automatically in CI as part of render tests
• Provides clear diagnostic output showing which selectors don't match

Testing:

• Ran go test -v -run TestPolicyAnalysis ./pkg/render/...
• Test successfully detects existing label inconsistencies in the codebase

Components affected:

• pkg/render/testutils/policy_analysis.go - Extraction and validation utilities
• pkg/render/policy_analysis_test.go - Main test file

The tool validates:

• Policy selectors match at least one pod in the same namespace
• Egress destination selectors match pods in target namespaces
• Ingress source selectors match pods in source namespaces

Release Note

NONE

For PR author

• Tests for change.
• If changing pkg/apis/, run make gen-files
• If changing versions, run make gen-versions