Repository: kubernetes
Issue: ValidatingAdmissionPolicy CEL validation rules do not seem to expand `__dot__` and `__slash__` as written in the documentation
Labels: kind/bug,sig/api-machinery,triage/accepted

### What happened?

Given the rule:
```
"!has(object.metadata.labels) || (has(object.metadata.labels) && !object.metadata.labels.helm__dot__sh__slash__chart == 'other')"
```
does not seem to expand the \_\_dot\_\_ and \_\_slash\_\_ because it gives the error 
```
Error from server (Invalid): error when creating "manifests/test.yaml": secrets "test" is forbidden: ValidatingAdmissionPolicy 'block-helm-other' with binding 'block-helm-other' denied request: expression '!has(object.metadata.labels) || (has(object.metadata.labels) && object.metadata.labels.helm__dot__sh__chart__chart == 'other')' resulted in error: no such key: helm__dot__sh__chart__chart
```
And of course just guarding it with another has() macro doesn't work since that will just return false.

You end up with
```
!has(object.metadata.labels) || (has(object.metadata.labels) && !has(object.metadata.labels.helm__dot__sh__chart__chart)) || (has(object.metadata.labels) && !has(object.metadata.labels.helm__dot__sh__slash__chart) && !object.metadata.labels.helm__dot__sh__slash__chart.startsWith('other'))
```
for example but that lets everything pass because `!has(object.metadata.labels.helm__dot__sh__slash__chart)` is returns true.

### What did you expect to happen?

This should block anything with the label like this:
```yaml
apiVersion: v1
kind: Secret
metadata:
  name: "test"
  labels:
    helm.sh/chart: other
```

instead it doesn't stop this at all.

### How can we reproduce it (as minimally and precisely as possible)?

The policies
```yaml
apiVersion: admissionregistration.k8s.io/v1alpha1
kind: ValidatingAdmissionPolicy
metadata:
  name: "block-helm-other"
spec:
  failurePolicy: Fail
  matchConstraints:
    resourceRules:
    - apiGroups:   ["*"]
      apiVersions: ["*"]
      operations:  ["CREATE", "UPDATE"]
      resources:   ["*"]
  validations:
    - expression: "!has(object.metadata.labels) || (has(object.metadata.labels) && object.metadata.labels.helm__dot__sh__slash___chart == 'other')"
---
apiVersion: admissionregistration.k8s.io/v1alpha1
kind: ValidatingAdmissionPolicyBinding
metadata:
  name: "block-helm-other"
spec:
  policyName: "block-helm-other"
  validationActions: [Deny]
```

and then try this secret:
```yaml
apiVersion: v1
kind: Secret
metadata:
  name: "test"
  labels:
    helm.sh/chart: other
data:
  test: ""
```

### Anything else we need to know?

_No response_

### Kubernetes version

<details>

```console
$ kubectl version
Client Version: version.Info{Major:"1", Minor:"27", GitVersion:"v1.27.2", GitCommit:"7f6f68fdabc4df88cfea2dcf9a19b2b830f1e647", GitTreeState:"clean", BuildDate:"2023-05-17T14:20:07Z", GoVersion:"go1.20.4", Compiler:"gc", Platform:"linux/amd64"}
Kustomize Version: v5.0.1
Server Version: version.Info{Major:"1", Minor:"27", GitVersion:"v1.27.1", GitCommit:"4c9411232e10168d7b050c49a1b59f6df9d7ea4b", GitTreeState:"clean", BuildDate:"2023-04-14T13:14:42Z", GoVersion:"go1.20.3", Compiler:"gc", Platform:"linux/amd64"}
```

</details>


### Cloud provider

None, local Ubuntu Server deployed using kubeadm

### OS version

<details>

```console
PRETTY_NAME="Ubuntu 22.04.2 LTS"
NAME="Ubuntu"
VERSION_ID="22.04"
VERSION="22.04.2 LTS (Jammy Jellyfish)"
VERSION_CODENAME=jammy
ID=ubuntu
ID_LIKE=debian
HOME_URL="https://www.ubuntu.com/"
SUPPORT_URL="https://help.ubuntu.com/"
BUG_REPORT_URL="https://bugs.launchpad.net/ubuntu/"
PRIVACY_POLICY_URL="https://www.ubuntu.com/legal/terms-and-policies/privacy-policy"
UBUNTU_CODENAME=jammy

Linux boson 5.15.0-72-generic #79-Ubuntu SMP Wed Apr 19 08:22:18 UTC 2023 x86_64 x86_64 x86_64 GNU/Linux
```
</details>


### Install tools

<details>
kubeadm version: &version.Info{Major:"1", Minor:"27", GitVersion:"v1.27.1", GitCommit:"4c9411232e10168d7b050c49a1b59f6df9d7ea4b", GitTreeState:"clean", BuildDate:"2023-04-14T13:20:04Z", GoVersion:"go1.20.3", Compiler:"gc", Platform:"linux/amd64"}
</details>


### Container runtime (CRI) and version (if applicable)

<details>
ii  containerd.io                         1.6.21-1                                amd64
</details>


### Related plugins (CNI, CSI, ...) and versions (if applicable)

<details>
None that should be related: csi.tigera.io, smb.csi.k8s.io, zfs.csi.openebs.io and Calico 3.25.1 for networking
</details>