auth/can-i: check subresource if it exists and belongs to resource

**What happened**:

The following command returns `no`:

```
$ kubectl auth can-i create pods --subresource=exec
```

Now try with random or non-existed subresource like `foobarbaz`:

```
$ kubectl auth can-i create pods --subresource=foobarbaz
```

Now it returns `true`. And same for:

```
$ kubectl auth can-i create pods/foobarbaz
```

**What you expected to happen**:

```
$ kubectl auth can-i create pods --subresource=thisisnotexist
```

It should return something like: `Subresource "thisisnotexist" does not belong to "pods"`

**How to reproduce it (as minimally and precisely as possible)**:

Just try the commands in your cluster.

**Anything else we need to know?**:

**Environment**:
- Kubernetes client and server versions (use `kubectl version`): Client: `v1.24.0`, Server: `v1.20`
- Cloud provider or hardware configuration: `on-prem`
- OS (e.g: `cat /etc/os-release`): `Ubuntu 20.04`

Start by reproducing the kubectl auth can-i commands shown in the issue against a cluster, then trace the auth can-i command entry point and subresource handling. Done means nonexistent subresources are rejected with a clear error while valid subresources such as exec continue to be checked normally.

Written by the indexing model from the issue text.