perf(epp): derive Scope allowed-key sets once at datalayer init

[LukeAVanDrie]

What type of PR is this?

/kind cleanup

What this PR does / why we need it:

datalayer.Scope rebuilt the allowedPut/allowedGet maps from Produces()/Consumes() on every invocation. Scope runs for every filter, every scorer, and every DataProducer on every request, while the declarations are fixed at plugin construction.

The sets are now derived once at startup: the runner calls datalayer.RegisterScopeSpecs(handle.GetAllPlugins()) next to ValidateAndOrderDataDependencies, after auto-created producers exist. Scope looks the spec up by the plugin's typed name, the same key ValidateAndOrderDataDependencies uses. A plugin that never went through registration is confined to nothing, with a one-time error log, so a wiring bug fails closed.

Benchmarks (benchstat, 10 interleaved runs per side, Apple M4 Pro):

                      │     main      │  this PR      vs base                │
BenchmarkScope sec/op
Scope/endpoints=10      533.4n ± 3%    318.2n ± 4%   -40.34% (p=0.000 n=10)
Scope/endpoints=100     1.733µ ± 4%    1.640µ ± 6%    -5.40% (p=0.018 n=10)

BenchmarkScope allocs/op
Scope/endpoints=10      10.000 ± 0%    7.000 ± 0%    -30.00% (p=0.000 n=10)
Scope/endpoints=100     10.000 ± 0%    7.000 ± 0%    -30.00% (p=0.000 n=10)

Which issue(s) this PR fixes:

Part of #2470

Release note (write NONE if no user-facing change):

NONE

Test plan

• New unit tests: an unregistered plugin is confined to nothing (declared reads and writes both denied, without panicking); re-registering a typed name replaces its spec
• Existing ./pkg/epp/datalayer/..., ./pkg/epp/scheduling/..., ./pkg/epp/requestcontrol/..., disagg profile-handler, and ./cmd/epp/... unit tests (tests that assert scoped data flow now register their plugins)
• make presubmit stages (signed-commits-check trips on the pre-existing GitHub merge commit 843d2271, which the DCO and signed-commit CI checks exempt)
• BenchmarkScope before/after with benchstat

[ahg-g]

This is an init logic, I recommend to call this explicitly from the datalayer init code instead of doing it on the fly

[LukeAVanDrie]

Done. The sets are now derived once at startup: the runner calls datalayer.RegisterScopeSpecs(handle.GetAllPlugins()) next to ValidateAndOrderDataDependencies, after auto-created producers exist, and Scope looks the spec up by the plugin's typed name (the same key ValidateAndOrderDataDependencies uses).

A plugin that never went through registration is confined to nothing, with a one-time error log, so a wiring bug fails closed instead of silently widening access. This also drops the lazy sync.Map and the plugin-as-map-key requirement.

[LukeAVanDrie]

updated bench data in PR description too