[FEATURE] backend for filterRules

### Certification

- [x] I certify I am an Epic Owner for Kubeflow Notebooks 2.0 and expected to create planning-related issues.

### Motivation

Platform admins (Joel) need a mechanism to define rules on WorkspaceKinds that dynamically filter
which WorkspaceKinds, imageConfigs, and podConfigs are visible and selectable based on context
(target namespace, selected options). The controller must store and validate these rules; the
backend must evaluate them at request time and return computed visibility and restriction attributes
in API responses.

### High Level Design / Mock-ups

_No response_

### Acceptance Criteria

- [ ] WorkspaceKind CRD accepts and validates filter rule declarations
- [ ] Backend evaluates filter rules at request time and returns computed visibility and restriction
attributes on WorkspaceKinds, imageConfigs, and podConfigs
- [ ] Backend rejects Workspace create/update when the selected option is restricted by a filter rule
- [ ] Invalid filter rule declarations are rejected by the controller webhook with clear error messages
- [ ] Unit tests cover rule evaluation across all scope types, match combinations, and edge cases