feat(vm): validate hotplug CPU/memory limits and project quotas

[eofff]

Description

Added HotplugResourcesValidator to VM webhook update validation pipeline.
The new validator checks hotplug CPU/memory changes against platform limits and namespace ResourceQuota availability (including migration-time double allocation).

Why do we need it, and what problem does it solve?

Hotplug resource updates can exceed safe VM limits or project quotas, which may lead to failed operations during migration and unclear runtime failures.
This change rejects invalid updates early at admission time with explicit validation errors.

What is the expected result?

On VM update, changed hotplug CPU/memory values are validated to ensure:

• CPU cores do not exceed 128
• memory does not exceed 256Gi
• requested CPU/memory fit project ResourceQuota limits and migration-time requirements

Invalid updates are rejected with clear error messages; valid updates pass.

Checklist

• The code is covered by unit tests.
• e2e tests passed.
• Documentation updated according to the changes.
• Changes were tested in the Kubernetes cluster manually.

Changelog entries

section: vm
type: feature
summary: "Add VM hotplug resources validator to enforce CPU/memory limits and ResourceQuota checks on update."

[diafour]

Also:

• changing memory.size and cpu.cores/cpu.coreFraction is not always a "hotplug", it may require reboot. Do we need this validation?
• It seems these validations are needed to prevent migration fails, so it only applicable for specific phases, e.g. no need to validate "Stopped" VMs.