When oldObj is nil (e.g. new map entry added during update), union
ratcheting incorrectly treats nil old and empty new as unchanged
membership, skipping validation entirely. Fix by checking
reflect.ValueOf(oldObj).IsNil() and disabling ratcheting when
oldObj is nil, so the new value is fully validated.

This affects Union, DiscriminatedUnion, and ZeroOrOneOfUnion
(via unionValidate).

Kubernetes-commit: 9a39e5c49faecdf0be53bbdec2d2751799aa774d

- Use reflect.ValueOf(oldObj).IsZero() instead of IsNil() so union
  validation works with non-nilable T (e.g. value types)
- Remove hasOldValue guard from inner loop conditionals; only check
  at the final ratcheting skip point
- Add doc comments explaining T is "any" rather than "comparable"
  because union members can be slices
- Add value-type subtests for Union and DiscriminatedUnion

Co-authored-by: Tim Hockin <thockin@google.com>

Kubernetes-commit: 3d39627cd9815f39fdf8243a60cd0768538e1b1f

- Code generator: use len() != 0 for slice/map member extractors
  instead of != nil, so empty slice/map are treated as "not set"
- Add slice and map members to union test types (both discriminated
  and undiscriminated)
- Add test coverage for nil vs empty, ratcheting, and nil oldObj
  with slice/map members

Co-authored-by: Tim Hockin <thockin@google.com>

Kubernetes-commit: b6ee759d8ea61a00d391f44b7fcffd06ff158009

Kubernetes-commit: d8a562b6476439fda82827fe1641dc2e307bc52d

Cherry pick of 137864

Kubernetes-commit: 82a705ccae809af6f50baa096b2568d5fbf531ee

Kubernetes-commit: 7e9c2c8eef26f99aa2f94d8e09d6d32de86c7769

Kubernetes-commit: 1687aa8c94e73c3a1744cb1f4498c0fbc41abe0c

[1.35] Update github.com/moby/spdystream from v0.5.0 to v0.5.1

Kubernetes-commit: 93828861e0b554581ba647d48efaba1ff579afa3