Allow ReferenceGrant `from` section to grant access to all namespaces

**What would you like to be added**: Right now, a `ReferenceGrant` requires very explicit listing in the `from` section of the allowed namespaces that may reference the resources in the `to` section. I suggest that this requirement be loosened and that access may be granted from *all* namespaces, either by omitting the `namespace` altogether or by allowing a sentinel value like `*` to explicitly mark it as a "wildcard" match for all namespaces.

This specifically is not about adding namespace label selectors to the `ReferenceGrant` API, although that might be a logical extension further down the line.

**Why this is needed**: This is mainly motivated by our use of the [kgateway](https://github.com/kgateway-dev/kgateway) implementation which recently introduced a "strict" reference grant mode that extends access restrictions to cross-namespace `GatewayExtension` (a kgateway CRD) references. Without this strict mode, references are allowed unconditionally without any `ReferenceGrant`, reducing the overall security of a Gateway setup as it exposes capabilities such as OAuth2 authentication through which a malicious actor could retrieve access tokens by attaching the authentication policy to their own, unintended route by referencing a globally shared `GatewayExtension`.

However, for our particular use case, we *do* want to enable use of certain `GatewayExtensions` across all namespaces such that tenants may reuse capabilities introduced by cluster operators unconditionally. Meanwhile we also want to allow tenants to create their own `GatewayExtension` resources which are scoped to their namespace and mustn't be used by other tenants. This makes it a perfect fit for kgateway's strict mode and `ReferenceGrants` for our globally shared resources.

The lack of support for allowing access from all namespaces means we have to find workarounds that are potentially quite brittle, such as generating a `ReferenceGrant` per namespace or maintaining a list by hand. Custom admission policies to implement a system like reference grants in lieu of kgateway's strict mode is also an option, but I'd prefer a standardized approach.

I anticipate concerns about this becoming the "default" for lazy users of the Gateway API such that they can just create blanket `ReferenceGrants` that span all namespaces. To this I counter the following:
* Some advantage is gained by still requiring and creating an explicit `ReferenceGrant` rather than implicitly allowing unrestricted access. It is a conscious decision by the user to opt-in to this less secure behaviour
* Implementations could be encouraged to add support for this capability in some toggleable manner. Then it's up to cluster operators whether to opt-into this behaviour

Start with the Gateway API ReferenceGrant definition and its current `from` section semantics, then review the issue discussion for compatibility and security concerns. Done would require an agreed API behavior for all namespaces, along with the corresponding specification, implementation, and conformance coverage.

Written by the indexing model from the issue text.