Add a check for scope change (Namespace <--> Cluster)

[everettraven]

This builds on top of #661 and focuses on adding a check to ensure that performing an update operation to a CustomResourceDefinition does not result in the scope being changed from Namespace to Cluster or vice versa.

If the proposal for adding this functionality to carvel-dev/kapp has been accepted prior to starting this work, all changes should be made against carvel-dev/kapp, otherwise the changes should be made against https://github.com/everettraven/kapp/tree/feature/crd-upgrade-safety-preflight

[everettraven]

Done in carvel-dev/kapp as of carvel-dev/kapp#901 - closing