feat(authz): add shoot-grafter group to authz RBAC and matchConditions

[Zaggy21]

Description

Extends the authz webhook to also intercept shoot-grafter.cloudoperators.dev resources by adding the API group to the authz chart RBAC and to the matchConditions in the AuthorizationConfiguration dev-env files.

What type of PR is this? (check all applicable)

• 🍕 Feature
• 🐛 Bug Fix
• 📝 Documentation Update
• 🎨 Style
• 🧑‍💻 Code Refactor
• 🔥 Performance Improvements
• ✅ Test
• 🤖 Build
• 🔁 CI
• 📦 Chore (Release)
• ⏩ Revert

Related Tickets & Documents

• Closes [FEAT] - Extend Authorization Webhook to cover shoot-grafter resources #2128

Added tests?

• 👍 yes
• 🙅 no, because they aren't needed
• 🙋 no, because I need help
• Separate ticket for tests # (issue/pr)

Please describe the tests that you ran to verify your changes. Provide instructions so we can reproduce. Please also list any relevant details for your test configuration

Added to documentation?

• 📜 README.md
• 🤝 Documentation pages updated
• 🙅 no documentation needed
• (if applicable) generated OpenAPI docs for CRD changes

Checklist

• My code follows the style guidelines of this project
• I have performed a self-review of my code
• I have commented my code, particularly in hard-to-understand areas
• My changes generate no new warnings
• New and existing unit tests pass locally with my changes

[Copilot]

Pull request overview

This PR extends the authz webhook’s interception and read-permissions so it can authorize shoot-grafter.cloudoperators.dev resources (in addition to greenhouse.sap) by updating the dev-env AuthorizationConfiguration matchConditions and the authz chart’s RBAC.

Changes:

• Updated matchConditions to route requests for both greenhouse.sap and shoot-grafter.cloudoperators.dev API groups to the authz webhook (secure + insecure dev env configs).
• Extended the authz webhook ServiceAccount ClusterRole permissions to include the shoot-grafter.cloudoperators.dev API group.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated no comments.

File	Description
dev-env/webhook/structured-authz-secure.yaml	Adds shoot-grafter.cloudoperators.dev to the webhook matchConditions API group filter.
dev-env/webhook/structured-authz-insecure.yaml	Adds shoot-grafter.cloudoperators.dev to the webhook matchConditions API group filter.
charts/authz/templates/rbac.yaml	Extends ClusterRole apiGroups to allow read access (get/list/watch) for shoot-grafter.cloudoperators.dev.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.