Support adopting existing radosgw buckets and users

The operator previously assumed it created every user and bucket it managed:
reconciling an existing resource could overwrite its user attributes or wipe its
bucket policy, and deleting a CRD always deleted the underlying RGW object (only
Bucket had retainOnDelete). That made taking over pre-existing radosgw state
unsafe. Make adoption first-class.

- add retainOnDelete to ObjectStoreUser and BucketAccess (dedicated users), so
  deleting the CRD orphans the RGW user instead of deleting it (symmetric with
  Bucket)
- merge bucket policy instead of replacing it: the operator marks its own
  statements with a cephrgwop* Sid and preserves any statement it does not own,
  so adopting a bucket with a hand-written policy keeps it; add Bucket
  managePolicy (default true) to opt out of policy management entirely
- only reconcile user attributes the spec sets: DisplayName when non-empty and
  Suspended is now an optional *bool, so adopting a user does not reset them
- record adoption: ObjectStoreUser/Bucket status.adopted (+ printcolumn) is true
  when the RGW object already existed on first reconcile
- add GetBucketPolicy + MergeBucketPolicy; keyed adoption detection off the
  status identity field so a Pending owner wait does not mislabel it
- regenerate CRDs/deepcopy; add docs/adoption.md and
  config/samples/05-adoption.yaml; cover the merge in policy_test.go

Claude-Session: https://claude.ai/code/session_016CEncETbf8cvy1PhsHfFHM

config/samples/05-adoption.yaml

@@ -0,0 +1,31 @@
+# Adopting an existing radosgw user + bucket. The operator takes them over in
+# place: no recreation, existing keys reused, existing bucket policy preserved.
+# retainOnDelete keeps the RGW objects if these CRDs are later deleted.
+# See docs/adoption.md.
+apiVersion: ceph.unkin.net/v1alpha1
+kind: ObjectStoreUser
+metadata:
+  name: legacy-owner
+  namespace: default
+spec:
+  # uid must match the existing RGW user id.
+  uid: legacy-owner
+  # Set maxBuckets to the existing user's limit (it otherwise defaults to 1000
+  # and would be applied). Leave displayName/suspended unset to keep them as-is.
+  maxBuckets: 1000
+  retainOnDelete: true
+---
+apiVersion: ceph.unkin.net/v1alpha1
+kind: Bucket
+metadata:
+  name: legacy-data
+  namespace: default
+spec:
+  # bucketName must match the existing bucket.
+  bucketName: legacy-data
+  ownerRef: legacy-owner
+  retainOnDelete: true
+  # managePolicy defaults to true: the operator merges its BucketAccess grants
+  # into the existing policy, preserving statements it does not own. Set it to
+  # false to leave the bucket policy entirely under manual control.
+  managePolicy: true