AntreaNetworkPolicy should not be applied to Pods in other Namespaces

[tnqn]

Describe the bug

Group validation was only performed when creating AppliedToGroup for namespaced group, there were two ways that can bypass the validation and apply the AntreaNetworkPolicy to Pods in other Namespaces:

1. Use a group which has child groups that select Pods in other Namespaces, for example:

apiVersion: crd.antrea.io/v1alpha1
kind: NetworkPolicy
metadata:
  name: anp-with-groups
  namespace: default
spec:
  priority: 5
  tier: securityops
  appliedTo:
    - group: "test-grp-parent"
  egress:
    - action: Drop
      to:
        - podSelector:
            matchLabels:
              app: nginx
      name: DropToThirdParty
      enableLogging: true
---
apiVersion: crd.antrea.io/v1alpha3
kind: Group
metadata:
  name: test-grp-parent
  namespace: default
spec:
  childGroups:
  - test-grp
---
apiVersion: crd.antrea.io/v1alpha3
kind: Group
metadata:
  name: test-grp
  namespace: default
spec:
  podSelector:
    matchLabels:
      app: client
  namespaceSelector: {}
---

2. Use a group which is namespace scope first, then change it to cluster scope. This may make the policy apply to cluster scope Pods in a short time but will be fixed after the policy is reprocessed because Group is resynced first, then ANP.

Expected

AntreaNetworkPolicy should never be applied to Pods in other Namespaces at any time point.

Versions:

• Antrea version (Docker image tag).
  cab72fc