feat(access): add AccessTag CRD to manage Zero Trust Access tags

[mxhob1]

What

Adds an AccessTag CRD + controller to manage Cloudflare Zero Trust Access tags declaratively.

Why

Access tags are account-level objects that must exist before an application can reference them. Today the operator only exposes AccessApplication.spec.tags (assign-only); if a referenced tag does not already exist, Cloudflare rejects the whole application update:

tags contain a tag that does not exist, tags must be created before assigning to an application (12130)

There is currently no CRD to create the tag objects, so they have to be created out-of-band via the API before any tagged AccessApplication will sync. This adds the missing declarative piece.

What it does

• New namespaced AccessTag CRD (networking.cloudflare-operator.io/v1alpha2), reusing AccessApplication's CloudflareDetails credential block. Single required field spec.name (the tag string referenced by AccessApplication.spec.tags).
• Controller ensures the tag exists (adopt-or-create): a pre-existing tag is adopted, never duplicated.
• A finalizer deletes the Cloudflare tag on CR removal only when app_count == 0. Tags are account-global while AccessTag CRs are namespaced, so a tag still referenced by an application — or by a sibling AccessTag in another namespace — is never deleted. Teardown is best-effort: a transient Cloudflare error never blocks CR deletion.

Implementation

• api/v1alpha2/accesstag_types.go (+ generated deepcopy / CRD / RBAC).
• internal/clients/cf/access_tag.go: CreateAccessTag / GetAccessTag / DeleteAccessTag, thin wrappers over cloudflare-go's native AccessTag API; added to the CloudflareClient interface; mock regenerated.
• internal/controller/accesstag/controller.go: reconciler wired into the manager, mirroring the AccessApplication controller's structure and helpers.
• Unit tests for the tag match/convert helper and the deletion guard, matching the package's existing pure-function test style.

Testing

• go build ./..., go vet ./... — clean
• make manifests generate — no drift
• make test — full suite green
• make lint (golangci-lint --new-from-rev main) — 0 issues

Mirrors the cloudflare_zero_trust_access_tag resource in the Cloudflare Terraform provider.