docs(security): point endpoint + credential docs at the real controls (#299, #251)

[thc1006]

What

Two documentation-accuracy fixes surfaced while verifying the acceptance criteria of #299 and #251. No behavior change — comment + field-godoc only (plus the CRD regeneration the godoc triggers).

#299 (任意 endpoint SSRF) — acceptance #4

The remoteControl.endpoint field godoc documented only the shape validation (host:port, DNS-1123, CEL) and never pointed at the control that actually bounds which host the operator will dial. Added a note that confining the destination is an admin egress concern, naming the two enforced controls:

• --remote-control-allowed-endpoint-hosts app-layer allow-list (empty = any, backward compatible)
• the egress NetworkPolicy at config/network-policy/allow-egress-traffic.yaml

The godoc flows into all four CRD copies via controller-gen (config/crd/bases, bundle/manifests, dist/chart/templates/crd, nephio/packages).

This closes the last open acceptance item for #299 (the allow-list, plaintext-relay gate, and egress policy already shipped in #300/#317/#324). #299 is closeable after this merges.

#251 (remoteControl.tls confused deputy)

The resolveRemoteControlTLS SECURITY comment called itself "a partial mitigation, not an authorization boundary" and pointed only at a hypothetical future SubjectAccessReview. That is now stale and understates what shipped: the opt-in credentialRefPolicy ValidatingAdmissionPolicy (ADR-0009) IS the enforced boundary — it makes the apiserver require the CR's writer to hold get on the referenced Secret (authorizer…namespace(request.namespace).name(…secretName).check('get')).

Rewrote the comment to name that policy as the real boundary, while staying honest that it is opt-in and enable: false by default, so the two in-resolver gates (reject API-credential Secret types; require an owner opt-in label) remain a partial mitigation out of the box.

#251 stays OPEN — remaining work: an automated envtest exercising a restricted (secrets-get-less) user against the live policy, and the decision on whether to flip the default posture. This PR only corrects the misleading comment.

Verification

• go build ./... + go vet ./api/... ./internal/controller/... clean
• make manifests bundle nephio-sync — all four CRD copies regenerated consistently (+6 lines each)
• Every factual claim in the new docs checked against the actual code: flag name + empty=permit-all (pkg/netutil/allowlist.go:50), NetworkPolicy path exists, and the VAP CEL scopes get to the referenced Secret (dist/chart/templates/admission/credential-ref-policy.yaml:37-40)