`linkerd authz` (and some `linkerd viz` paths) only recognize `HTTPRoute.policy.linkerd.io`

Nobody has claimed this yet.

## Summary

The CLI only understands `policy.linkerd.io`. `linkerd authz` calls
`k8s.AuthorizationsForResource` (`cli/cmd/authz.go:62`), which in
`pkg/k8s/policy.go:138` does:

```go
} else if target.Kind == HTTPRouteKind && target.Group == PolicyAPIGroup {
route, err := k8sAPI.L5dCrdClient.PolicyV1alpha1().HTTPRoutes(p.Namespace).Get(ctx, string(target.Name), metav1.GetOptions{})
```

with `PolicyAPIGroup = "policy.linkerd.io"` (`pkg/k8s/k8s.go:41`).

As a consequence, an `AuthorizationPolicy` targeting `HTTPRoute.gateway.networking.k8s.io` is
**silently dropped** from the `linkerd authz` output; users get an empty/partial
authorization list for a workload that is in fact authorized.

## Expected behaviour

1. `linkerd authz` resolves `AuthorizationPolicy` targets in both
`policy.linkerd.io` and `gateway.networking.k8s.io`.
2. The output disambiguates the group, e.g. a ROUTE column value of
`HTTPRoute.gateway.networking.k8s.io/my-route` (or an extra column), since the
same name can exist in both groups.
3. At minimum, unrecognized target kinds/groups produce a warning on stderr instead
of being silently skipped, consistent with the other error paths in
`AuthorizationsForResource`.

## Notes / dependencies

Implementing (1) with typed clients needs gateway-api Go types; the repo currently
pins `sigs.k8s.io/gateway-api v0.8.1` (`go.mod:53`), which predates the `v1` API
surface. See https://github.com/linkerd/linkerd2/issues/15619

## How can it be reproduced?

```bash
# with the gateway-api CRDs installed
kubectl apply -f - <<'YAML'
apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
name: gw-route
namespace: emojivoto
spec:
parentRefs:
- group: policy.linkerd.io
kind: Server
name: web-http
rules:
- matches:
- path:
type: PathPrefix
value: /
---
apiVersion: policy.linkerd.io/v1alpha1
kind: AuthorizationPolicy
metadata:
name: gw-route-authz
namespace: emojivoto
spec:
targetRef:
group: gateway.networking.k8s.io
kind: HTTPRoute
name: gw-route
requiredAuthenticationRefs:
- kind: ServiceAccount
name: default
namespace: emojivoto
YAML

linkerd authz -n emojivoto deploy/web
# the gw-route-authz row is missing, with no warning
```

Start at cli/cmd/authz.go:62, pkg/k8s/policy.go:138, and pkg/k8s/k8s.go:41, then inspect the pinned gateway-api dependency at go.mod:53. Reproduce the provided HTTPRoute and AuthorizationPolicy manifest with the linkerd authz command; done means both API groups are reported distinctly and unsupported targets warn rather than disappear.

Written by the indexing model from the issue text.