enforce validation on upstream services

[ikethecoder]

• Closes Enforce validation on upstream service hosts for particular data planes #122

[rustyjux]

Looks good. Some docs that would be nice to see alongside this:

• something in infra doc/ops outlining the upstream namespace restrictions capability (basically what you have in the issue description)
• what data planes we are using upstream validation on (is this the plan for Emerald?)
• updates to client tech docs to let them know about this requirement on relevant DPs.

I also wonder how possible it would be to resolve the deserialized data CodeQL alert? Or is it also a false positive?

Alas I'd also tweaked mock_keycloak to have a ns with different perm-domains for custom certs tests so I'll need to do a little conflict resolution there.