Feature: supply old resources to `crossplane resource validate` to test transition rules

## Problem

[CEL](https://kubernetes.io/docs/reference/using-api/cel/) rules that reference `oldSelf` (transition rules) only fire on update. The API server skips them on create because there's no prior object to compare against.

`crossplane resource validate` validates resources with no way to supply prior versions, so it always exercises the create path. There's no way to test immutability constraints or other transition rules with the current CLI.

## Proposed change

Add an `--old ` flag that mirrors the existing `` argument (comma-separated files, directories, or `-` for stdin):

```
crossplane resource validate [--old ]
```

The CLI would match each old object to its corresponding new object by kind/name/namespace, then pass the pair as `(obj, oldObj)` into the validation call. This triggers update validation instead of create validation and populates `oldSelf` in CEL rules. Resources with no matching old object fall back to the create path as today.

The Kubernetes [CEL library](https://pkg.go.dev/k8s.io/apiextensions-apiserver/pkg/apiserver/schema/cel#Validator.Validate) already handles `(obj, oldObj)` pairs, so this should only require a CLI change to surface it.

Start at the implementation of `crossplane resource validate` and trace how its existing `resources` sources are read and matched. Review the Kubernetes CEL `Validator.Validate` API for `(obj, oldObj)` pairs. Done means an `--old` source accepts the documented inputs, matching objects use update validation, and unmatched objects retain create validation.

Written by the indexing model from the issue text.