[4.10.x] fix(subscription): do not panic when validating a subscription to an API without context

[mergify]

This is an automatic copy of pull request #1781 done by Mergify.

---

https://gravitee.atlassian.net/browse/APIM-14905

Problem

validateContextRefs called GetName() on the API's and application's contextRef without checking whether either exists. ContextRef() returns spec.contextRef verbatim, so an unset context yields a nil pointer wrapped in a non-nil interface, and the admission webhook panics instead of returning a validation error:

admission webhook "v1alpha1.gravitee.io.subscription" denied the request:
panic: runtime error: invalid memory address or nil pointer dereference

The user gets a stack trace instead of a reason, and nothing is stored.

Fix

Guard each read with the existing HasContext() on ContextAwareObject, and give each failure its own actionable message:

• API has no contextRef → "unable to subscribe to API [x] because it does not reference a management context"
• application has no contextRef → equivalent message for the application
• both present but different → the existing "management contexts must match" error, unchanged

The mismatch branch is byte-identical to master, so the existing create_withContext_and_contextMissmatch_test.go is unaffected.

Behaviour note for the reviewer

The ticket asks for "if neither side has a context, let the subscription through". This PR rejects that case instead, for two reasons:

• Application.contextRef is required by its CRD and ApiDefinition/ApiV4Definition contextRef is optional, so "neither" is unreachable in practice — the case that actually panics is API-without-context plus application-with-one, matching the reported stack trace.
• The subscription controller builds its APIM client from the API's contextRef (controllers/apim/subscription/internal/update.go:50), so admitting a subscription to a context-less API would create a resource that can never reconcile.

Happy to flip to "skip the check" if you'd rather match the ticket's literal wording.

Tests

• test/integration/admission/subscription/create_withContext_and_apiWithoutContext_test.go
  — API with no context, application with one, asserting the admission error. The subscription is handed to the admission controller directly and never applied: the reconciler cannot build an APIM client for a context-less API, so the resource would never reach a terminal state.
• internal/admission/subscription/validate_test.go — table-driven, all six context combinations. Note it lives in package because validateContextRefs is unexported, and CI's make unit only runs test/unit/..., so it does not execute in CI as things stand. go test ./internal/... is green today if we want to extend that target (separately — it also revives two dormant internal/k8s tests).

---

Cherry-pick of 43db68d has failed:

On branch mergify/bp/4.10.x/pr-1781
Your branch is up to date with 'origin/4.10.x'.

You are currently cherry-picking commit 43db68d7.
  (fix conflicts and run "git cherry-pick --continue")
  (use "git cherry-pick --skip" to skip this patch)
  (use "git cherry-pick --abort" to cancel the cherry-pick operation)

Changes to be committed:
	new file:   test/integration/admission/subscription/create_withContext_and_apiWithoutContext_test.go
	new file:   test/unit/admission/subscription/suite_test.go
	new file:   test/unit/admission/subscription/validate_context_refs.go

Unmerged paths:
  (use "git add <file>..." to mark resolution)
	both modified:   internal/admission/subscription/validate.go

To fix up this pull request, you can check it out locally. See documentation: https://docs.github.com/en/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/checking-out-pull-requests-locally

[mergify]

Cherry-pick of 43db68d has failed:

On branch mergify/bp/4.10.x/pr-1781
Your branch is up to date with 'origin/4.10.x'.

You are currently cherry-picking commit 43db68d7.
  (fix conflicts and run "git cherry-pick --continue")
  (use "git cherry-pick --skip" to skip this patch)
  (use "git cherry-pick --abort" to cancel the cherry-pick operation)

Changes to be committed:
	new file:   test/integration/admission/subscription/create_withContext_and_apiWithoutContext_test.go
	new file:   test/unit/admission/subscription/suite_test.go
	new file:   test/unit/admission/subscription/validate_context_refs.go

Unmerged paths:
  (use "git add <file>..." to mark resolution)
	both modified:   internal/admission/subscription/validate.go

To fix up this pull request, you can check it out locally. See documentation: https://docs.github.com/en/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/checking-out-pull-requests-locally

[sonarqubecloud]

Quality Gate passed

Issues
1 New issue
0 Accepted issues

Measures
0 Security Hotspots
100.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud