ResolveMemberIdentity checks only one of Member/MemberFrom is provided, and then tries to resolve identity.

An unfortunate reality is that the GVK is not always properly filled in when reading a resource from the K8s API server, and there are functions that need the Kind to be filled in to work (e.g.

ExternalOnlyType is a KCC resource type that KCC does not support as a core resource, but does support referencing externally in IAM.