Tighten ReferencingWorkloads uniqueness to kind+name across config CRDs

[JAORMX]

Follow-up from #4777 (MCPAuthzConfig CRD)

The shared WorkloadReference type uses +listMapKey=name only. Across all config CRDs (MCPOIDCConfig, MCPAuthzConfig, etc.), a ReferencingWorkloads entry is keyed by name alone, which is not unique across workload kinds (an MCPServer and a VirtualMCPServer can share a name in the same namespace). #4777 deliberately aligned to the existing name-only convention rather than diverging.

Scope

• Evaluate moving ReferencingWorkloads to a composite kind+name key (listMapKeys) uniformly across the config CRDs that track referencing workloads.
• This is pre-existing and repo-wide — should be addressed in one place, not per-CRD.

Context

• Raised during the Add MCPAuthzConfig CRD for backend-agnostic authorization #4777 multi-agent review (LOW severity, "discuss").