feature: restrict claiming API bindings

[s-urbaniak]

Feature Description

During development of https://github.com/kcp-dev/kcp/pull/2089 it came to our attention that API bindings are special in the virtual API export service.

Today, similar to any other resource API bindings can be claimed like any other resource. This is dangerous as it opens up the possibility for service providers to claim API bindings and thus be able to import any arbitrary API into user workspaces. Creating API bindings should be in the autonomy of the actual workspace users and thus claiming it should be prohibited.

Proposed Solution

Needs discussion and design.

Alternative Solutions

No response

Want to contribute?

• [X] I would like to work on this issue.

Additional Context

No response

[stevekuznetsov]

In the past we spoke not of forbidding it entirely, but allowing it if and only if the permission claim was for "everything", that is - make it clear to users that if they accept a claim on APIBindings, they are giving someone else total admin over all the data in the workspace.