flake: TestAPIBinding - "not found exactly on one shard"

[embik]

It looks like my PR #3338 added a certain flakiness to TestAPIBinding.

apibinding_test.go:427: Error: cowboys.wildwest.dev is forbidden: User "kcp-admin" cannot list resource "cowboys" in API group "wildwest.dev" at the cluster scope: access denied
apibinding_test.go:439: 
        Error Trace:	/home/prow/go/src/github.com/kcp-dev/kcp/test/e2e/apibinding/apibinding_test.go:439
        Error:      	Not equal: 
       	            	expected: 1
       	            	actual  : 0
        Test:       	TestAPIBinding
        Messages:   	cowboys not found exactly on one shard, but on 0/1 

Here's a couple of failed runs:

• https://public-prow.kcp.k8c.io/view/s3/prow-public-data/pr-logs/pull/kcp-dev_kcp/3282/pull-kcp-test-e2e-shared/1910191974799904768

• https://public-prow.kcp.k8c.io/view/s3/prow-public-data/pr-logs/pull/kcp-dev_kcp/3368/pull-kcp-test-e2e-shared/1910037926343872512

• https://public-prow.kcp.k8c.io/view/s3/prow-public-data/pr-logs/pull/kcp-dev_kcp/3353/pull-kcp-test-e2e-shared/1904846765551521792

• https://public-prow.kcp.k8c.io/view/s3/prow-public-data/pr-logs/pull/kcp-dev_kcp/3368/pull-kcp-test-e2e-sharded/1910060684582850560

• https://public-prow.kcp.k8c.io/view/s3/prow-public-data/pr-logs/pull/kcp-dev_kcp/3356/pull-kcp-test-e2e-sharded/1905169547917266944

And more.

It looks like the user in question doesn't get immediate access to the virtual workspace endpoint for APIExports, gets rejected, and the test fails. This checks needs to be made more robust and wrapped in a wait/retry, probably.