What happened?

The xpkg spec says that function packages may contain only CustomResourceDefinitions (to provide schemas for their inputs) and no other resource types. However, the package manager does not currently validate this and will happily install any resource that's included in a Function package, as long as it's registered in the scheme used for parsing packages.

Incidentally, since crank uses the same linter code when building packages, it will happily build a function package containing other kinds of resources.

How can we reproduce it?

1. Build a function package that includes an XRD (with crank xpkg build) and push it.
2. Install the function package.
3. Observe that the XRD is created in the control plane.

What environment did it happen in?

Crossplane version: tested on main, but this appears to affect all versions that support function packages.