Fix the RBAC rule check for API requests

You asked an assistant for RBAC (Kubernetes role-based access control) so a controller can read configmaps in one namespace. It granted every verb on every resource in every API group, across the whole cluster. The platform team now checks each rule against concrete requests, to see exactly what it allows.

An assistant wrote allowed_requests(rule, requests). It is in the editor. It has a bug. Find it and fix it.

Input and output:

• rule: one RBAC rule as "<apiGroups>;<resources>;<verbs>;<scope>". The first three fields are comma-separated lists. For example ";configmaps;get,list,watch;prod".
• requests: API requests, each "<apiGroup>,<resource>,<verb>,<namespace>", such as ",secrets,get,kube-system". The list can be empty.
• Return the requests the rule allows, as a list of strings.

Rules the tests check:

• Split the rule on ;. If it does not give exactly 4 fields, the rule allows nothing.
• Split each of the first three fields on , into a list of entries. An empty field is a list with one empty entry. The empty string is the name of the core API group, where configmaps, secrets and pods live.
• A value matches a list when any entry is *, wherever the * sits in the list, or when an entry equals the value exactly. Matching is case sensitive.
• The scope "cluster" covers every namespace, as a ClusterRoleBinding does. Any other scope, even "*" or an empty one, is one namespace name and covers only requests with exactly that namespace.
• Split each request on ,. Skip a request that does not give exactly 4 parts.
• A request is allowed when its group, resource and verb each match the rule's list for that field, and the scope covers its namespace.
• Return each allowed request exactly as given, in input order. Keep duplicates.