Please ensure your pull request adheres to the following guidelines:

• For first time contributors, read Submitting a pull request
• All code is covered by unit and/or runtime tests where feasible.
• All commits contain a well written commit description including a title,
  description and a Fixes: #XXX line if the commit addresses a particular
  GitHub issue.
• If your commit description contains a Fixes: <commit-id> tag, then
  please add the commit author[s] as reviewer[s] to this issue.
• All commits are signed off. See the section Developer's Certificate of Origin
• Provide a title or release-note blurb suitable for the release notes.
• Are you a user of Cilium? Please add yourself to the Users doc
• Thanks for contributing!

Fix nodeSelector validation in CiliumNetworkPolicy Specs array

This PR fixes a bug where namespaced CiliumNetworkPolicy objects with nodeSelector specified in the specs array were being silently accepted but ignored, instead of being properly rejected with a validation error.

Problem

The issue was that nodeSelector validation was only applied to the singular spec field but not to individual rules within the specs array. This led to inconsistent behavior:

• ✅ spec: { nodeSelector: {} } → Correctly rejected
• ❌ specs: [{ nodeSelector: {} }] → Silently accepted but ignored

Solution

Added the missing nodeSelector validation check inside the r.Specs loop in the Parse method of CiliumNetworkPolicy. Now both cases consistently reject the policy with the error message: "Invalid CiliumNetworkPolicy spec: rule cannot have NodeSelector"

Testing

• Added comprehensive test case in TestParseWithNodeSelector to cover the specs array scenario
• All existing tests pass, ensuring no regressions
• Verified the exact policy from the issue is now properly rejected

Fixes: #40268

Fix validation bug where namespaced CiliumNetworkPolicies with nodeSelector in specs array were silently accepted but ignored. Now properly rejected with validation error.