A DeviceClass mapping or transformation output named pods is accepted, then silently replaced by the PodSet count

### What happened: `pods` is reserved for Kueue's own Pod-count accounting, and the Workload webhook says so: ```go // pkg/webhooks/workload_webhook.go:198 if name == corev1.ResourcePods { allErrs = append(allErrs, field.Invalid(path.Key(string(name)), corev1.ResourcePods, "the key is reserved for internal kueue use")) } ``` The operator configuration does not apply the same reservation. `validateDeviceClassMappings` checks the mapping name for label-key syntax, length, and uniqueness, and nothing else, so this loads: ```yaml apiVersion: config.kueue.x-k8s.io/v1beta2 kind: Configuration resources: deviceClassMappings: - name: pods deviceClassNames: - h100.example.com - a100.example.com ``` The DRA charge then lands under that name. `totalRequestsFromPodSets` merges the preprocessed DRA resources into the PodSet's requests without filtering reserved names, and `dropExcludedResources` only removes the prefixes an administrator configured. What discards it is in the scheduler: ```go // pkg/scheduler/flavorassigner/flavorassigner.go:693 if a.cq.RGByResource(corev1.ResourcePods) != nil { if podSet.Requests != nil { podSet.Requests.Set(corev1.ResourcePods, int64(podSet.Count)) } ``` `Set` replaces rather than adds, in both request backends. So a ClusterQueue that tracks pod quota overwrites whatever the DRA path computed under that name with the PodSet count. **What you expected to happen**: The configuration is refused, the way the same name is refused on a Workload. Instead it is accepted and the charge is silently replaced. **How to reproduce it (as minimally and precisely as possible)**: Load the configuration above through `config.Load` and hand it to `config.Validate`, as `cmd/kueue/main.go` does. No error is reported for the mapping name. Then a single Pod claiming 8 devices of a mapped class is charged `pods: 8` by the DRA path, and reaches admission as `pods: 1`. ``` mapping name parsed as "pods" DRA envelope stored: pods=8 after the flavor assigner's Set: pods=1 ``` **Anything else we need to know?**: `ResourceTransformation.Outputs` has the same shape: an output named `pods` is accepted, is written into the same request list, and is overwritten there too. A user cannot write that key on a Workload, but an administrator can synthesize it from either side of the configuration. This is not specific to prioritized lists. The existing `ExactCount` path charges through the same merge, so any DeviceClass mapping named `pods` is affected today. /kind bug /area dra