Enhance add-access-rule command UX with intuitive name-based flags

[rkoster]

Summary

This PR enhances the user experience of the add-access-rule command by replacing the positional GUID-based SELECTOR argument with intuitive flags that accept human-readable names and support cross-space/org resolution.

Related to: cloudfoundry/community#1438

Motivation

The original add-access-rule command required users to manually construct GUID-based selectors (e.g., cf:app:d76446a1-f429-4444-8797-be2f78b75b08), which was cumbersome and error-prone. This PR follows CF CLI conventions from commands like add-network-policy to provide a more user-friendly interface.

Changes

Command Interface Improvements

Before:

cf add-access-rule allow-frontend apps.identity cf:app:d76446a1-f429-4444-8797-be2f78b75b08 --hostname backend

After:

# Simple case - app in current space
cf add-access-rule allow-frontend apps.identity --source-app frontend-app --hostname backend

# Cross-space access
cf add-access-rule allow-other apps.identity --source-app api-client --source-space other-space --hostname backend

# Cross-org access
cf add-access-rule allow-prod apps.identity --source-app client --source-space prod-space --source-org prod-org --hostname api

# Space-level rule
cf add-access-rule allow-monitoring apps.identity --source-space monitoring --hostname api

# Org-level rule
cf add-access-rule allow-platform apps.identity --source-org platform --hostname shared-api

# Any authenticated app
cf add-access-rule allow-all apps.identity --source-any --hostname public-api

# Advanced: raw selector still supported
cf add-access-rule allow-raw apps.identity --selector cf:app:GUID --hostname backend

New Flags

• --source-app APP_NAME - Specify source app by name (resolves to GUID)
• --source-space SPACE_NAME - Specify space context for app lookup or create space-level rule
• --source-org ORG_NAME - Specify org context for space/app lookup or create org-level rule
• --source-any - Allow any authenticated app
• --selector SELECTOR - Raw GUID-based selector for advanced users

Terminology Update

• Renamed all "target" terminology to "source" throughout codebase
• Access rules specify the source (who can access), not the target
• Updated AccessRuleWithRoute.TargetName → SourceName
• Updated resolveAccessRuleTarget() → resolveAccessRuleSource()
• Updated access-rules list command table header: "target" → "source"

Enhanced Output

The command now displays verbose output showing both human-readable source and the resolved selector:

Adding access rule allow-frontend for route backend.apps.identity as admin...
  scope: app, source: frontend-app
  selector: cf:app:d76446a1-f429-4444-8797-be2f78b75b08
OK

Validation & Error Handling

• Validates exactly one primary source is specified
• Provides helpful error messages when app not found in current space
• Suggests using --source-space and --source-org flags for cross-space/org access
• Follows CF CLI patterns from add-network-policy command

Domain Integration

• Added --enforce-access-rules and --access-rules-scope flags to create-shared-domain and create-private-domain commands
• Updated domain resource with new fields

Testing

• ✅ 17 comprehensive test cases for add-access-rule command
• ✅ Updated 19 actor tests to use new SourceName field
• ✅ All tests passing (36/36)
• ✅ Covers validation, resolution, error handling, and cross-space/org scenarios

Breaking Changes

• Removed positional SELECTOR argument - This is a breaking change, but acceptable since the access rules feature has not been released yet
• Users must now use one of the new flags (--source-app, --source-space, --source-org, --source-any, or --selector) instead

Checklist

• Tests added/updated and passing
• Documentation (help text) updated
• Breaking changes documented
• Follows CF CLI conventions
• Manual testing against live CF deployment (requires CAPI backend support)

Next Steps

This PR is marked as draft pending:

1. Manual testing against a CF deployment with access rules API support
2. Integration testing with full CF ecosystem
3. Review from CF CLI maintainers

[rkoster]

Don't worry about this PR just yet, just doing some more POC work on the RFC: cloudfoundry/community#1438