[Network] Support Azure Firewall Policy Kube Selector Groups (az network firewall policy kube-selector-group)

### Preconditions

- [x] No need to upgrade Python SDK or the Python SDK is ready.

### Related command

az network firewall policy kube-selector-group create
az network firewall policy kube-selector-group show
az network firewall policy kube-selector-group list
az network firewall policy kube-selector-group update
az network firewall policy kube-selector-group delete

### Resource Provider

Microsoft.Network/firewallPolicies/kubeSelectorGroups

### Description of Feature or Work Requested

Add az CLI support (in the azure-firewall extension) to manage Kube Selector Groups on an Azure Firewall Policy, matching the new PowerShell cmdlets (PR #30007).

A Kube Selector Group is a child resource of a firewall policy that scopes Kubernetes workloads by labels. Each group has:

- podSelector — matches pods by labels

- namespaceSelector — matches namespaces by labels

Each selector is a Kubernetes label selector composed of matchLabels (key/value map) and/or matchExpressions (list of { key, operator ∈ In|NotIn|Exists|DoesNotExist, values }).

Commands needed (CRUD on the kubeSelectorGroups child resource): create / show / list / update / delete.

Behavior notes for the CLI implementation:

- delete returns 204 (No Content).

- update should be read-modify-write — only overwrite the selector the user passes; leave the unspecified selector unchanged (passing an explicit empty/null clears it).

Selectors should be accepted as command parameters (e.g. --pod-selector / --namespace-selector via CLI shorthand syntax), not separate builder commands.

### Minimum API Version Required

2025-09-01

### Swagger PR link / SDK link

https://github.com/Azure/azure-rest-api-specs/pull/44865

### Request Example

See the kubeSelectorGroups examples in the swagger PR: https://github.com/Azure/azure-rest-api-specs/pull/44865/files

### Target Date

2026-09-30

### PM Contact

Suren.Jamiyanaa@microsoft.com

### Engineer Contact

samankal@microsoft.com

### Additional context

- PowerShell PR (reference behavior): https://github.com/Azure/azure-powershell/pull/30007

- Location: azure-firewall extension (same place as az network firewall policy rule-collection-group)