Matchlabel criteria excludes namespace on ExtraResource

### What happened?

During development of a feature, we encoutered unexpected behaviour from the ExtraResource function.
The goal was to populate a Listenerset using httproutes from its namespace, and so we used extraresource to fecth httproutes by namespace and label (we only use a specific route type).

```
{{- $xr := getCompositeResource . }}
{{- $namespace := get $xr.metadata "namespace" }}
---
apiVersion: meta.gotemplating.fn.crossplane.io/v1alpha1
kind: ExtraResources
requirements:
routes:
apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
namespace: {{ $namespace }}
matchLabels:
routetype: "prj-hostname"
```

Only this combination of criteria returns HttpRoutes with label "prj-hostname" from all namespaces.
It seems to stem from the way the [search specs are used](https://github.com/crossplane-contrib/function-go-templating/blob/9222efc18ca5ed8f47782025fc3024551ded13b9/extraresources.go#L47).

The question is then, is this behaviour intentional? The namespace parameter in extraresource is not yet part of the documentation, and we were wondering if it will enventually be possible to search by label in a specific namespace.

### How can we reproduce it?
The specified example and two Httproutes in different namespaces should be enough to reproduce this behaviour.

### What environment did it happen in?
Function version: 0.12.2
Crossplane 2.2.0
Cluster: Azure AKS
Kube 1.35.3

Start with extraresources.go at the linked search-spec handling and reproduce the report using two HTTPRoutes in different namespaces with the provided template. Check how namespace and matchLabels are combined, then verify that the intended namespace-scoped label behavior is covered by the resulting behavior and documented semantics.

Written by the indexing model from the issue text.