antctl observe command

[salv-orlando]

Add antctl observe command for live flow streaming from Flow Aggregator

antctl observe is a new command that streams live flow records from a Flow Aggregator's FlowStreamService gRPC endpoint, similar to "kubectl logs -f". It supports filtering (Namespace, Pod, label selector, Service, flow type, IP/CIDR,direction), --since/--max-count/--follow, text/JSON output (with--human-readable byte formatting), automatic Flow Aggregator discovery.
It can be executed from any node with access to K8S API server, provided user has the pods/portforward role. It also supports in-Pod execution from within the Flow Aggregator itself.

New package pkg/antctl/raw/observe/:

• command.go (cobra command, in-Pod vs. remote connection orchestration)
• filter.go (CLI-flags-to-request building)
• connect.go (direct dial or SPDY tunnel through the /portforward subresource, with automatic fallback)
• discovery.go (cluster-wide or Namespace-scoped Flow Aggregator discovery)
• auth.go (bearer token/file, client cert, or captured exec/OIDC token; in-Pod mode uses the Pod's own ServiceAccount via rest.InClusterConfig)
• render.go (text and line-delimited JSON renderers, safe for --follow's unbounded output).

Registered in antctl's command and debug-command lists, now including FlowAggregator mode.
The Client-side gRPC keepalive is tuned just above the FlowStreamService's default 5-minute enforcement policy to avoid disconnections due to GOAWAY.

Notes:

• authentication with captured OIDC token has currently not been tested.
• discovery is not available when multiple flow aggregator instances are running: in that case user must explicitly target a F-A instance.

Unit tests
pkg/antctl/raw/observe/{connect,filter,render}_test.go cover request building, dial/tunnel connection-mode selection and fallback, and text/JSON rendering (formatting, truncation, human-readable sizes).

e2e tests

• new test/e2e/antctlobserve_test.go (TestAntctlObserve) covers:
• intra/inter-Node and Pod<->external flow capture;
• every filter type; --since,--max-count, --follow, and their combination (including the server closing the stream at max_count even while following);
• text vs. JSON output;
• ServiceAccount bearer-token auth and missing-credential handling;
• refusing to auto-discover across multiple Flow Aggregator instances plus explicit --flow-aggregator/--flow-aggregator-address targeting;
• direct vs. auto-with-tunnel-fallback connection modes under NetworkPolicy-enforced denial
• clean exit on server-side disconnect.

This PR also fixes an antctl ClusterRole gap (missing "get" on deployments) and gives test-e2e-kind.sh's Flow Aggregator instances distinct Helm release names (cluster-scoped RBAC names are release-name-, not Namespace-derived).