feat: Introduce cross namespace support

[igorbernstein]

This takes a wider approach to address feedback from #93.

• Introduces a ClusterHeadscale CRD (analogous to ClusterIssuer in cert-manager)
• Changes HeadscaleRef from a bare string to a structured { name, kind } type
• Bumps the API package to v1beta2 to account for the breaking changes

The PR is noisy. I've tried to split it into three reviewable commits:

1. Mechanical rename of CRDs to v1beta2
2. Structured HeadscaleRef
3. ClusterHeadscale introduction

One non-obvious consequence: HeadscaleAutoApprover now watches ClusterHeadscale events and fans out to approvers across all namespaces when the referenced instance is cluster-scoped. Worth a closer look in
the third commit.

Happy to open these as separate PRs, or you can review per commit — whichever you prefer.

[igorbernstein]

This might've been a mistake. I'm wondering if we should follow the gateway api model of ReferenceGrants instead?

• keep Headscale namespaced
• still introduce structured HeadscaleRefs
• add ReferenceGrants in the same namespace as the HeadscaleInstance to allow access across namespaces