Possible DoS by using overlapping multiple SinkBindings

[cardil]

Describe the bug
Eventing allows users to create a faulty situation, where multiple sink bindings are constantly reconfiguring a single subject. This may lead to a DoS of a whole Kubernetes cluster, by resource depletion. Such situation can happen both intentionally, but also by chance by using different but overlapping labels.

$ kn source binding list
NAME     SUBJECT                                    SINK                 AGE   CONDITIONS   READY   REASON
bind-1   Service:serving.knative.dev/v1:takeme      ksvc:event-display   39s   2 OK / 2     True    
bind-2   Service:serving.knative.dev/v1:foo=bar     ksvc:event-display   31s   2 OK / 2     True    
bind-3   Service:serving.knative.dev/v1:fizz=bazz   ksvc:event-display   11s   2 OK / 2     True    
bind-4   Service:serving.knative.dev/v1:moo=goo     ksvc:event-display   4s    2 OK / 2     True 

$ kubectl get kservice takeme -o jsonpath='{.metadata.generation}'
9803

Expected behavior
Knative Eventing should detect that multiple SinkBindings are targeting overlapping resources, and mark them as not ready, showing misconfiguration to user in status. This validation should happen no matter if SB are selecting subject by name or by label selector.

To Reproduce

1. Create sink ex.: kn service create event-display --image gcr.io/knative-releases/knative.dev/eventing-contrib/cmd/event_display
2. Create a subject that sink bindings will fight for, ex.: kn service create takeme --image=gcr.io/knative-samples/helloworld-go -l foo=bar -l fizz=bazz -l moo=goo
3. Create more than one sink binding that targets the same subject:
   1. kn source binding create bind-1 --subject 'Service:serving.knative.dev/v1:takeme' --sink event-display --ce-override 'sink=1'
   2. kn source binding create bind-2 --subject 'Service:serving.knative.dev/v1:foo=bar' --sink event-display --ce-override 'sink=2'
   3. kn source binding create bind-3 --subject 'Service:serving.knative.dev/v1:fizz=bazz' --sink event-display --ce-override 'sink=3'
   4. kn source binding create bind-4 --subject 'Service:serving.knative.dev/v1:moo=goo' --sink event-display --ce-override 'sink=4'

Knative release version
main

Additional context

Resolving this issue would probably fix #5510 as well.

[cardil]

/area security

[cardil]

Maybe this issue should be treated as CWE-400

[cardil]

@knative/security-wg-leads PTAL

[github-actions]

This issue is stale because it has been open for 90 days with no
activity. It will automatically close after 30 more days of
inactivity. Reopen the issue with /reopen. Mark the issue as
fresh by adding the comment /remove-lifecycle stale.

[rhuss]

/remove-lifecycle stale

[pierDipi]

/triage accepted