Simplify ReferenceGrant resolution

[rainest]

From #5965 (comment)

Our ReferenceGrant validity check code originated in the context of GWAPI backends, and code is fairly specific to that context. We've since expanded use of them for references to Secrets and KongPlugins, and the code is a bit contrived to try and fit those other uses into the same context.

We want to refactor the ReferenceGrant handling functions into generic utilities for ReferenceGrants without regard to the objects involved in the references. Revised utilities should validate whether a requested <source namespace>:<resource GVK> -> <target resource GVK, optional name> relationship is permitted by some ReferenceGrant in the target resource namespace for any resources that satisfy the client.Object interface