chore(webhooks): register identity API types in controller-manager Scheme

Add identityv1alpha1 to the controller-manager Scheme to enable UserIdentity
webhook registration. Without this registration, the webhook server fails to
start with 'no kind is registered' error.

Changes:
- Add identityv1alpha1 import to controller-manager
- Register identityv1alpha1.AddToScheme in init()
- Use proper Kubernetes error wrappers (NewForbidden, NewBadRequest, NewInternalError)
- Restrict User email updates to self-service only

This fixes the test failures where webhooks were returning 'connection refused'
because the controller-manager was crashing during webhook setup.

Author: OscarLlamas6

cmd/milo/controller-manager/controllermanager.go

@@ -91,6 +91,7 @@ import (
 	resourcemanagerv1alpha1webhook "go.miloapis.com/milo/internal/webhooks/resourcemanager/v1alpha1"
 	crmv1alpha1 "go.miloapis.com/milo/pkg/apis/crm/v1alpha1"
 	iamv1alpha1 "go.miloapis.com/milo/pkg/apis/iam/v1alpha1"
+	identityv1alpha1 "go.miloapis.com/milo/pkg/apis/identity/v1alpha1"
 	infrastructurev1alpha1 "go.miloapis.com/milo/pkg/apis/infrastructure/v1alpha1"
 	notificationv1alpha1 "go.miloapis.com/milo/pkg/apis/notification/v1alpha1"
 	quotav1alpha1 "go.miloapis.com/milo/pkg/apis/quota/v1alpha1"
@@ -170,6 +171,7 @@ func init() {
 	utilruntime.Must(resourcemanagerv1alpha1.AddToScheme(Scheme))
 	utilruntime.Must(infrastructurev1alpha1.AddToScheme(Scheme))
 	utilruntime.Must(iamv1alpha1.AddToScheme(Scheme))
+	utilruntime.Must(identityv1alpha1.AddToScheme(Scheme))
 	utilruntime.Must(notificationv1alpha1.AddToScheme(Scheme))
 	utilruntime.Must(crmv1alpha1.AddToScheme(Scheme))
 	utilruntime.Must(quotav1alpha1.AddToScheme(Scheme))