feature request: extend readonly proxy with the ability to deny specific kinds

kubectx -r <ctx> blocks writes, but everything readable is still readable. When handing someone or something a read-only shell, it would be nice to also block sensitive kinds such as Secrets.

Proposed solution

Add a --deny flag to the read-only shell:

kubectx -r --deny secrets prod
kubectx -r --deny secrets,configmaps --deny leases.coordination.k8s.io prod

• The proxy extracts the API group and resource from each request path (core and named groups, namespaced/cluster-scoped, subresources, legacy /watch/ etc) and returns a 403 Forbidden Status for denied resources on any HTTP method, including watches and --raw.
• Entries are validated against the cluster's API discovery at startup. Plural, singular, short names and Kinds are accepted (secret, cm, Deployment etc); resource.group limits a rule to one group. An unknown name is a hard error, so a typo cannot silently leave a resource exposed.
• The shell banner lists the resolved denied resources.