TemplateInstance: fail if non namespaced scope resource should be deployed

[FabianKramm]

At the moment it is possible to define cluster scoped resources in a template and a TemplateInstance in a namespace that deploys these resources. This can lead to problematic behavior, since two templateinstances in two different namespaces that would point to the same template (which is allowed and encouraged) would override the clusterresource of each other and is basically currently the result of some kind of undefined behavior.

Hence, we should restrict and check during deployment of a TemplateInstance if a given resource is namespaced or cluster scoped and let the TemplateInstance fail if it is a cluster scoped resource.