modifying namespace spec.finalizers via PATCH should return a validation error

**What happened**:

PATCH `{"spec":{"finalizers":null}}` doesn't clear the finalizers and also doesn't return an error.

**What you expected to happen**: It should return an error (use the /finalize subresource).

**How to reproduce it (as minimally and precisely as possible)**: see #77086

Start by examining how PATCH handles namespace spec.finalizers and compare it with the /finalize subresource behavior described in the issue. Use the minimal reproduction referenced by #77086; done means PATCH returns a validation error and finalizers can still be changed through /finalize.

Written by the indexing model from the issue text.