Additional validation checks for ClusterClass and managed topologies

[fabriziopandini]

Detailed Description
This is a follow up of #4928 (comment)

The ClusterClass and managed topologies proposal introduced an initial set of web hook validation rules.
This issue is about adding more validation rules in order to make things even more robust, e.g.

• Ensure all Ref are valid (*)
  • Ref can only reference template objects (Kind ends with Template suffix)
  • namespace if set should be a valid namespace name
  • apiVersion must be set and be a valid
  • kind must be set and be a valid
  • name must be set and be a valid (extends the first rule in this sublist)
• Ensure all the required Ref exists in a ClusterClass
• TDB ensure the user can't change a Cluster from unmanned to managed
• ...

(*) Ideally this should be consistent with all the other references existing in the API types

/kind feature

[sbueringer]

Sounds like a good issue to parallelize after #4928 has been merged.

[ykakarap]

I can work on this :)
/assign

[vincepri]

/milestone v0.4

[sbueringer]

@ykakarap Can you please also extend the KubeadmControlPlane webhook to also validate the name of the infrastructure machineTemplate ObjectReference

More details in: #4986 (comment)

[ykakarap]

@sbueringer will do 👍🏼