Deny tags in `k8s-*:*` format

## Problem Statement

We did not add limitations on the content of tags. It is possible that a resource (like `KongService`, `KongPlugin`) sets a tag like `k8s-namespace:other-namespace` to impersonate the metadata of other resources. This could confuse KO to parse errors from Kong and setting status of resources.

We need to constrain the content of tags to prevent the impersonating of k8s metadata.

## Proposed Solution

Stricter constraint: deny all tags in `k8s-*:*` format
Looser constraint: deny only the tags for k8s metadata currently in use:
- `k8s-group:*`
- `k8s-version:*`
- `k8s-kind:*`
- `k8s-namespace:*`
- `k8s-name:*`
- `k8s-uid:*`
- `k8s-generation:*`

in both CELs on `spec.tags` and generating tags from spec/annotations.

## Additional Information

...

## Acceptance Criteria

- [ ] the `spec.tags`/`tags` field in CRDs has the CELs to disable the tag format to carry k8s metadata
- [ ] KO rejects the tags in the format in generating tags
- [ ] Docs and tests are added