fix(kds): clone resource on update meta (backport of #10460) (#12122)

While investigating the KDS code in the `release-2.7` branch, I noticed
that the resource is not cloned in `UpdateResourceMeta`. This issue was
fixed in releases >= 2.8, but it remains unresolved in 2.7. I'm not sure
if the fix fully addresses the issue, but it seems related

```yaml
unexpected fault address 0x0
fatal error: fault
[signal SIGSEGV: segmentation violation code=0x80 addr=0x0 pc=0x1538f3b]

goroutine 5145 gp=0xc001cb5180 m=4 mp=0xc000100008 [running]:
...
github.com/kumahq/kuma/pkg/kds/context.DefaultContext.UpdateResourceMeta.func2(0xc0032183c0?, {0x4874b50, 0xc0013ff0e0})
```

```yaml
goroutine 45485 gp=0xc001005880 m=nil [runnable]:
...
github.com/kumahq/kuma/pkg/kds/context.DefaultContext.If.func15(0xc0047cb8c0, {0x4874b50, 0xc0016fbbd8})
```

in both goroutine `0x4874b50` is the meta address.

Automatic cherry-pick of #10460 for branch release-2.7

Generated by
[action](https://github.com/kumahq/kuma/actions/runs/12051462482)

cherry-picked commit 3d506ed

---------

Signed-off-by: Jakub Dyszkiewicz <[email protected]>
Signed-off-by: Lukasz Dziedziak <[email protected]>
Co-authored-by: Jakub Dyszkiewicz <[email protected]>
Co-authored-by: Lukasz Dziedziak <[email protected]>

pkg/kds/context/context.go

@@ -222,8 +222,12 @@ func HashSuffixMapper(checkKDSFeature bool, labelsToUse ...string) reconcile.Res
 
 func UpdateResourceMeta(fs ...util.CloneResourceMetaOpt) reconcile.ResourceMapper {
 	return func(_ kds.Features, r core_model.Resource) (core_model.Resource, error) {
-		r.SetMeta(util.CloneResourceMeta(r.GetMeta(), fs...))
-		return r, nil
+		newObj := r.Descriptor().NewObject()
+		newMeta := util.CloneResourceMeta(r.GetMeta(), fs...)
+		newObj.SetMeta(newMeta)
+		_ = newObj.SetSpec(r.GetSpec())
+
+		return newObj, nil
 	}
 }