Lakom uses warning instead of failure policy Ignore

[vpnachev]

What this PR does / why we need it:
Lakom uses warning instead of failure policy Ignore

Which issue(s) this PR fixes:
Fixes #

Special notes for your reviewer:

Release note:

Lakom admission controller is extended with a new flag `--insecure-allow-untrusted-images`. When it is set, the admission webhook returns just warning but still allows the images that are not signed or are not signed with trusted keys. 

Lakom gardener extension controller configuration has new field `allowUntrustedImages`, it is used to control the lakom admission controller flag `--insecure-allow-untrusted-images`.

:warning: Lakom admission webhooks now always use failure policy `Fail` and it is no longer possible to change it to `Ignore`. If you want to allow untrusted images
- for the extension controller you can set the field `allowUntrustedImages` to true
- for the lakom application you can set the flag  `--insecure-allow-untrusted-images` to true
Both configs are also exposed via the helm charts values and ControllerDeployment config.

[dimityrmirchev]

Not a strong opinion, so I am fine both ways.

As a general comment I think that "skip" is not the proper term to use here since we still do the validation, but allow the image even if validation fails. So IMO "allow" should be the better term.

A second note. What is the use case for this change and why is it better than the ability to ignore denied requests as it is now?

[vpnachev]

A second note. What is the use case for this change and why is it better than the ability to ignore denied requests as it is now?

The failure policy in kubernetes is scoped only to completing the admission review process, not the result of the admission review, i.e. whether the change is allowed or not. Failure policy Ignore is useful when the admission webhook is not highly available or the network is not reliable and the admission result is optional, i.e. the admission result of the webhook is not mandatory.

Lakom is deployed HA and by default runs locally to the cluster (in-cluster for the seeds and in the control plane for the shoots), so we should not have any expectation that the admission reviewes are subject to failure because of unreliable network, unavailable lakom instances, etc. Failure policy Ignore was proposed as a way to disable the image verification checks when it is expected unsigned or signed by untrusted signing keys images to be used, for this case an admission review response allowing the request but with warning is more appropriate.

There are several benefits from this change:

1. Remove the copied and modified version of sigs.k8s.io/controller-runtime/pkg/webhook/admission, so no need to maintain the copy of 3rd party lib.
2. From monitoring point of view, unsigned images will not be counted as API server failed to complete the admission review process, but as denied requests.
3. The error message send to clients will correctly reflect why the request is denied, instead of representing it as failure to complete the admission review. Currently, when the webhook is running in Ignore policy, the clients do not receive any information that the image has issues.

[dimityrmirchev]

Two small suggestions that are completely optional

/lgtm

[dimityrmirchev]

/lgtm