[v0.7|main] Make admission rejection message more useful for namespace creation

[crobby]

Issue:

rancher/rancher#47585

Problem

Webhook rejection message was not useful in this situation

Solution

Include user, verb, resource in the rejection message.

Testing notes

To make this situation show up, you can create a roletemplate like the one below

apiVersion: management.cattle.io/v3
builtin: false
context: project
description: ""
displayName: nomanagenamespace
external: false
hidden: false
kind: RoleTemplate
metadata:
  generateName: rt-
rules:
- apiGroups:
  - ""
  resources:
  - namespaces
  verbs:
  - '*'
- apiGroups:
  - management.cattle.io
  resources:
  - projects
  verbs:
  - get
  - list
  - watch
  - updatepsa

Then you can create a clusterroletemplatebinding to bind that role to a user that has no other permissions on a given cluster.

With that in place, login as the user to which the crtb was bound and navigate to the cluster and try to create a namespace in a project.

Prior to this fix, the error message provided just said "Unauthorized".
After this fix, the error message will look like: admission webhook "rancher.cattle.io.namespaces.create-non-kubesystem" denied the request: User "u-7qhg2" does not have permission "manage-namespaces" on project "p-w7252"

[ericpromislow]

Would be good if there could be a unit test for this. I tried messing with the test file, but always get an actual error "error when creating sar, server unavailable" instead of a fabricated one. Not sure if the underlying function is properly mocked.

Looks fine otherwise.