honor webhook http 422 as unconditional deny

[Sanskarzz]

Summary

This PR fixes webhook HTTP 422 handling to match RFC THV-0017.

Both validating and mutating webhook middleware now treat an HTTP 422 response from a webhook as an unconditional deny, regardless of whether the webhook failure_policy is fail or ignore.

Fixes #4663

Changes

• Added a shared helper in pkg/webhook/errors.go to detect webhook errors that must always deny.
• Updated pkg/webhook/validating/middleware.go to deny on webhook HTTP 422 before applying failure policy.
• Updated pkg/webhook/mutating/middleware.go to deny on webhook HTTP 422 before applying failure policy.
• Added focused tests covering HTTP 422 behavior for both middleware types under both fail and ignore policies.

Why

Per RFC THV-0017, webhook HTTP 422 is a semantic rejection and should not be treated like a normal operational error. Previously, failure_policy: ignore could allow the request to continue even when the webhook returned 422.

Test plan

• Unit tests (task test)
• E2E tests (task test-e2e)
• Linting (task lint-fix)
• Manual testing (describe below)

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 68.74%. Comparing base (ccad93a) to head (34e81b4).
⚠️ Report is 1 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #4703      +/-   ##
==========================================
+ Coverage   68.72%   68.74%   +0.02%     
==========================================
  Files         515      515              
  Lines       53590    53602      +12     
==========================================
+ Hits        36829    36850      +21     
+ Misses      13919    13912       -7     
+ Partials     2842     2840       -2     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.