kubectl-ate: add update egress-policy

[oldsj]

agent-substrate/substrate#1659 added kubectl ate get and create egress-policy, but an existing policy
can only be changed by calling UpdateActorEgressPolicy directly. This adds:

kubectl ate update egress-policy <actor-name> -a <atespace> -f policy.yaml

The RPC takes the policy's uid and version as preconditions:

• The manifest sets both (as get -o yaml output does): they're sent as is,
  so the update fails if the policy changed since it was read.
• The manifest sets neither: the command reads the current policy and uses
  its uid and version, replacing it whatever its version.
• Only one is set: rejected.

As with get, a NotFound is resolved into "actor not found" or "actor has no
egress policy" by reading the actor. The second points at create.

Manifest parsing and metadata defaulting reuse the create path. The README's
Egress Policies section documents the new verb.

Tests:

• Unit tests for the runner: preconditions taken from the current policy,
  preconditions sent as is, a half-set precondition, an actor with no policy,
  a missing actor, a policy deleted between read and update, and a read failure.
• Argument tests for the new command.
• go vet and golangci-lint pass on cmd/kubectl-ate.
• Not yet run against a live control plane.