Add namespace selector as scope

Currently there're are 3 scopes how a Sealed Secret can be encrypted:
* strict
* namespace
* cluster-wide

We're maintaining a multi-tenant cluster and users are asking how they can reuse an existing Sealed Secret for a different namespace without encrypting again or make them cluster-wide.

A possible approach would be to support encryption of Sealed Secrets using a namespace selector as each tenant has its own set of labels on their namespaces.

Something like:
```
kubeseal --scope namespace-selector --selector owner=team1 -oyaml < secret.yaml > sealedsecret.yaml
```

The Sealed Secrets controller would only decrypt the Sealed Secret if the corresponding namespace has the label `owner` set to `team1`.

What are your thoughts about adding namespace selector as scope? Is this a feature which we might add?

Start by tracing how kubeseal currently represents and handles the strict, namespace, and cluster-wide scopes, then inspect how the Sealed Secrets controller determines whether a Secret may be decrypted. Define the namespace-label matching behavior and failure cases before assessing the CLI and controller changes. Done should include tests covering selector-based reuse and rejection of non-matching namespaces.

Written by the indexing model from the issue text.