Implement the discovery mechanism for non-payload extension binaries. This involves developing the logic in openshift-tests to scan for ImageStreamTags that have the testextension.redhat.io/component label. The code should identify the component and the binary path from the ImageStreamTag's annotation (testextension.redhat.io/binary). This will allow openshift-tests to discover and use extension binaries contributed by optional operators or other external components.

Create the necessary admission control logic to ensure openshift-tests only executes extension binaries from approved sources. The orchestrator must check for the existence of TestExtensionAdmission Custom Resource Definitions (CRDs) and their instances. Only ImageStreams and their corresponding extension binaries that are explicitly permitted by a TestExtensionAdmission object should be allowed to run. A synthetic test should be generated for any discovered but unpermitted extension to provide clear feedback to the user.