fix(serde): add #[serde(default)] to Option<Vec/Map> resource fields

[indyjonesnl]

Problem

K8s API serialization omits empty arrays. `Option<Vec>` fields without `#[serde(default)]` then fail deserialization round-trip when the source JSON omits the field entirely — even though that's the standard K8s wire format for "no items".

Affected ~80 fields across ~15 resource files. Minimal objects (a Service with no `ports`, a Pod with no `tolerations`, etc.) couldn't round-trip through our types.

Fix

For every `Option<Vec>`, `Option<HashMap<K, V>>`, `Option<BTreeMap<K, V>>` field on a resource struct, add `#[serde(default)]` alongside the existing `#[serde(skip_serializing_if = "Option::is_none")]`. Preserve any `rename = "..."` overrides — order normalized to `rename → default → skip_serializing_if`.

Split into four commits by file batch (A, A-qualified-maps, B, C) for reviewability:

• Batch A: `admission_webhook`, `authentication`, `authorization`, `autoscaling` (35 fields).
• Batch A qualified maps: `std::collections::HashMap` paths missed by the bulk regex in batch A (6 more fields in admission_webhook + autoscaling).
• Batch B: `certificates`, `componentstatus`, `coordination`, `csi`, `dra` (10 fields).
• Batch C: `endpoints`, `endpointslice`, `event`, `flowcontrol`, `ingress`, `ingressclass`, `networking`, `policy`, `rbac` (40 fields).

Mechanical change — no behavior change for any object that does populate these fields. Restores round-trip compatibility for objects that omit them.

Verification

`cargo build --workspace --locked` clean. No new test failures vs baseline.

Depends on #32 for green CI.