Tighten ReferencingWorkloads uniqueness to kind+name across config CRDs

[JAORMX]

Follow-up from #4777 (MCPAuthzConfig CRD)

The shared WorkloadReference type uses +listMapKey=name only. Across all config CRDs (MCPOIDCConfig, MCPAuthzConfig, etc.), a ReferencingWorkloads entry is keyed by name alone, which is not unique across workload kinds (an MCPServer and a VirtualMCPServer can share a name in the same namespace). #4777 deliberately aligned to the existing name-only convention rather than diverging.

Scope

• Evaluate moving ReferencingWorkloads to a composite kind+name key (listMapKeys) uniformly across the config CRDs that track referencing workloads.
• This is pre-existing and repo-wide — should be addressed in one place, not per-CRD.

Context

• Raised during the Add MCPAuthzConfig CRD for backend-agnostic authorization #4777 multi-agent review (LOW severity, "discuss").

[ChrisJBurns]

Done. All three config CRDs that track ReferencingWorkloads now use the compound (kind, name) listMapKey:

• MCPAuthzConfig — Add MCPAuthzConfig CRD for backend-agnostic authorization #4777 (commit 193ff75)
• MCPOIDCConfig and MCPExternalAuthConfig — Apply compound (kind, name) listMapKey to MCPOIDCConfig and MCPExternalAuthConfig ReferencingWorkloads #5498 (PR Use compound listMapKey on sibling config statuses #5508)

The shared WorkloadReference entries are now keyed by (kind, name), so an MCPServer and a VirtualMCPServer sharing a name no longer collide under merge-patch. Closing as resolved.