Only allow cluster to update management_project to namespace (and
descendants) of the cluster.

For instance-level cluster, this is meaningless so skip for this cluster
type.