chore: document existing WebhookConfiguration admission behaviour

[embik]

We have a kcp-secific admission plugin validatingwebhook (and one for mutating webhooks as well), but I cannot find any documentation on it. We should make sure we document how ValidatingWebhookConfigurations and MutatingWebhookConfigurations work in kcp.

My understanding of a quick code scan is that the plugin finds the source of an API (i.e. where its APIExport lives) and calls webhooks configured in that workspace.

Whoever picks this ticket up has to confirm this behaviour (e.g. what happens to ValidatingWebhookConfigurations in the workspace of the APIBinding that backs an object) and write a small documentation / tutorial page to be published in our docs folder.

Please add an e2e test case as well to make sure we don't break this behaviour in the future.