VAP for Upgrades

[chris-kaiser-7]

What would you like to be added:
Validating Admission Policy for Upgrades to prohibit the following:

• Installation of experimental CRDs on top of standard channel CRDs (within the same API group)
• Installation of monthly releases
• Installation of older releases

Why this is needed:
This is required for the release changes https://docs.google.com/document/d/1iG6RKVJFZUxG1mZ4NbUL5Tm09n_zDck-LukYmUXoQ7c/edit?tab=t.0

[chris-kaiser-7]

/assign

[chris-kaiser-7]

I interpreted "Installation of older releases" as basically any CRD with version <1.4.0 that has this VAP installed. Should this instead be any CRD that is an older version? like if they install 1.4.0 bundle then install 1.5.0 HTTPRoute or something in the future then install 1.4.0 HTTPRoute, should that be an error? or is it good enough to just check the version of the VAP?