1. Generalized cluster selection for "HasPermission" AdmissionConstraints
Before the "constraintNewWorkspaceCluster" was seen as special case, that also was too general. This way it's straight forward to extend to other permissions
2. Separated "cluster authorization" into a separate Constraint which is applied to all ClusterSets. Before the authoritzation was more an optimization of the cluster precedence