Add Kuadrant/TokenRateLimitPolicy reservation fields and Reserve/Commit reconciler branch

Summary

Add the cluster-wide mode switch and per-limit reservation CRD fields, plus the reconciler logic that generates Reserve/Commit wasm actions (Reservation mode) or today's Check/Report actions (CheckReport mode).

Design: RFC 0021, reference-level section "Expected work by component" (kuadrant-operator).

Depends on: Kuadrant/wasm-shim#402 (RateLimitReserve/RateLimitCommit service types).

Acceptance Criteria

• Kuadrant CR field spec.tokenRateLimiting.mode (enum Reservation/CheckReport, default Reservation)
• TokenRateLimitPolicy per-limit reservation field (amount, ttl CEL expressions), including defaults/overrides merge behavior across the policy hierarchy
• Default amount/ttl CEL generation for limits that omit reservation: flat uint(5000) for amount, route's HTTPRoute.spec.rules[].timeouts.backendRequest for ttl
• Reconciler branch generating the correct wasm actions based on effective state:
  • Effectively active: Reserve action (ServiceType::RateLimitReserve) at request phase + Commit action (ServiceType::RateLimitCommit) at response/stream-end phase
  • The reservation_id returned by the Reserve call is captured (via an on_reply → Store action into stored_values) and reused in the Commit action's request. Per wasm-shim#402 this capture/reuse is entirely configuration-driven, so the operator must generate the wasm config that stores the id from the Reserve reply and passes it back on Commit.
  • Effectively inactive: today's ratelimit-check-service (hits_addend=0) + ratelimit-report-service (hits_addend=<actual>)
• Regular RateLimitPolicy reconciliation path is untouched (separate code, verified by existing tests still passing)
• Docs covering both modes
• E2e tests covering both modes and the upgrade-window transition (old Limitador/operator without reservation support)

Notes for reviewers

PR description should include: how to review (suggested order: CRD field additions → default CEL generation → reconciler branching → e2e), and manual verification (apply a TokenRateLimitPolicy in each mode, inspect generated wasm plugin config for the expected actions).

Start with RFC 0021 and its kuadrant-operator “Expected work by component” section, then inspect the Kuadrant and TokenRateLimitPolicy CRD definitions and reconciler entry points. Done means both modes, reservation defaults and merges, wasm Reserve/Commit configuration, existing regular RateLimitPolicy behavior, documentation, and the specified e2e and upgrade-transition coverage are implemented.