Add protected namespaces possibility

[ThomasCAI-mlv]

I propose the concept of protected namespaces.
The idea is to add an extra layer of security to protect sensitive data produced by given namespaces, so that only a protected namespace can consume data from another protected namespace. The public namespaces will not be able to consume data produced by protected namespaces.

In ns4kafka, this protection will be at the ACL level:

• ✅ Protected namespace can grant ACL to another protected namespace
• ❌ Protected namespace cannot grant ACL to a public namespace
• ✅ Public namespace can grant ACL to a protected namespace
• ✅ Public namespace can grant ACL to another public namespace
• ❌ Protected namespace cannot create public ACL (giving access to all other namespaces of the cluster)

Other info:

• Namespaces are considered protected if their config spec.protectionEnabled is true
• Namespaces will be public by default.
• For Michelin D2 data use case, it would provide an extra security in addition to the usage of Oauth2 on Confluent Cloud (which replaces API key & API secret auth).

[loicgreffier]

@ThomasCAI-mlv Looks good for me overall. Some minor improvements.

Regarding the wording, what do you think about public namespace and private (or protected) namespace?

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
100.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[loicgreffier]

@ThomasCAI-mlv LGTM 😀