Sub-tenant with its own resourceQuotas is not limited by parent keys it doesn't declare #5185

A tenant that declares its own resourceQuotas becomes a separate pool for every key, not only for the keys it declares. Keys the parent bounds but the child doesn't declare stop limiting the child. The declaration gate also checks only the keys the parent declares, so a child can declare any key the parent doesn't have.

Example:

• parent cust has memory: 10Gi and cpu: 10
• tenant admin of cust creates child dev with only cpu: 2
• dev is now not limited by memory at all, since it's not a member of the parent's pool anymore and its own ResourceQuota has no memory

Same for a key the parent doesn't have but an ancestor does, and the same will apply to GPU budgets (<class>.gpuclass.cozystack.io/devices, gpuclass.cozystack.io/devices) from cozystack/community#99, which use the ordinary pool rules. A parent with gpuclass.cozystack.io/devices: 4 can't stop its child from declaring h100.gpuclass.cozystack.io/devices: 100.

ref:

• poolRootOf in internal/controller/tenantquota/pool.go, a tenant is a pool root as soon as it declares any key
• validateTenantResourceQuotas in pkg/registry/apps/application/quota.go, only parent keys are checked
• design-proposal: tenant quotas as reservation limits community#48 keeps the pool semantics unchanged, so the gate from it doesn't close this

I think a child that declares its own quotas should still be bounded by every key its ancestors declare: either it has to declare each of them (carving its slice), or its usage keeps counting in the ancestor's pool for the keys it doesn't declare. And a child key that is a class key should count against the parent's all-class GPU key.