fix(supervisor-network): warn on unsupported L7 access presets

[lunarwhite]

Summary

Emit a visible warning when an L7 endpoint uses an unsupported access preset (e.g. access: allow) during proxy-side preset expansion. Previously these values were silently ignored, leaving endpoints with no expanded rules and no diagnostic when traffic was denied.

Policy load and deny behavior are unchanged. This is observability only.

Related Issue

Closes #2008

Related: #2158 (invalid access: allow reports policy_denied; this PR adds the missing load-time warning but does not fix incomplete policy shape)

Changes

• Return warnings from expand_access_presets for unsupported access values (read-only, read-write, and full remain supported)
• Extract access_preset_rules helper to centralize preset expansion logic
• Emit expansion warnings via OCSF ConfigStateChangeBuilder in both OPA policy-load paths (from_proto_with_pid, preprocess_yaml_data), matching existing L7 validation warning plumbing
• Add unit test for access: allow (warning emitted, rules not expanded)
• Assert warnings.is_empty() on existing supported-preset expansion tests

Testing

• mise run pre-commit passes
• Unit tests added/updated
• E2E tests added/updated (if applicable)

Checklist

• Follows Conventional Commits
• Commits are signed off (DCO)
• Architecture docs updated (if applicable)

[copy-pr-bot]

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.