Add advanced API validation

[timebertt]

What would you like to be added:

A validating webhook could be added to the sharder that validates the following aspects of ControllerRing objects:

• there should be no duplicates in spec.resources[] and spec.resources[].controlledResources[]

Additionally, the webhook could validate shard leases:

• shard lease names should be RFC 1123 DNS Labels so that they are valid label values (as required for the shard and drain labels)

Why is this needed:

Advanced API validation would prevent misconfiguration and confusion.
Such validation cannot be implemented using CEL validation rules in the ControllerRing CRD.
Also, validation for shard leases can only be added using webhooks.