Model ReferenceGrants for shared resources

*Description*:
Support cases where it is intentional to expose a resource broadly.

There are multiple cases where it is necessary to create `ReferenceGrant` objects for many namespaces, often automatically. Two examples I was struggling with has been providing cluster-shared ExtAuth and ExtProc services I expect developers to find useful.

There are very few reasons I would want to restrict access to these services, so I want to model the relationship as "open" or by some selector on the namespace.

```yaml
apiVersion: gateway.envoyproxy.io/v1alpha1
kind: MultiNamespaceReferenceGrant
metadata:
name: my-extauth-securitypolicy-grant
namespace: my-namespace
spec:
from:
group: gateway.envoyproxy.io/v1alpha1
kind: SecurityPolicy
namespaceSelector: {}
to:
- group: ""
kind: Service
name: "my-extauth-service"
```

Background:
I've been working around this with a Kyverno generate policy, but it's a really important component to be in a policy, so I built an operator around this CRD to generate `ReferenceGrant` resources and model the relationship explicitly with `MultiNamespaceReferenceGrant`. Seems useful to model the relationship over an opt-out.

[optional *Relevant Links*:]
I believe #3450 is related here.