feat: add ReferenceGrant RBAC permissions and enhance Docker workflow

[dspo]

Type of change:

• Bugfix
• New feature provided
• Improve performance
• Backport patches
• Documentation
• Refactor
• Chore
• CI/CD or Tests

What this PR does / why we need it:

Pre-submission checklist:

• Did you explain what problem does this PR solve? Or what new features have been added?
• Have you added corresponding test cases?
• Have you modified the corresponding document?
• Is this PR backward compatible? If it is not backward compatible, please discuss on the mailing list first

[github-actions]

conformance test report

apiVersion: gateway.networking.k8s.io/v1
date: "2025-06-24T04:31:23Z"
gatewayAPIChannel: standard
gatewayAPIVersion: v1.2.0
implementation:
  contact: null
  organization: APISIX
  project: apisix-ingress-controller
  url: https://github.com/apache/apisix-ingress-controller.git
  version: v2.0.0
kind: ConformanceReport
mode: default
profiles:
- core:
    failedTests:
    - HTTPRouteCrossNamespace
    - HTTPRouteWeight
    result: failure
    skippedTests:
    - HTTPRouteHTTPSListener
    statistics:
      Failed: 2
      Passed: 30
      Skipped: 1
  name: GATEWAY-HTTP
  summary: Core tests failed with 2 test failures.

[github-actions]

conformance test report

apiVersion: gateway.networking.k8s.io/v1
date: "2025-06-24T04:35:30Z"
gatewayAPIChannel: standard
gatewayAPIVersion: v1.2.0
implementation:
  contact: null
  organization: APISIX
  project: apisix-ingress-controller
  url: https://github.com/apache/apisix-ingress-controller.git
  version: v2.0.0
kind: ConformanceReport
mode: default
profiles:
- core:
    result: partial
    skippedTests:
    - HTTPRouteHTTPSListener
    statistics:
      Failed: 0
      Passed: 32
      Skipped: 1
  name: GATEWAY-HTTP
  summary: Core tests partially succeeded with 1 test skips.