[dmt] add webhook configuration annotations lint rule

[diyliv]

Summary

• WebhookConfiguration annotations rule (webhook_configuration.go): checks that every ValidatingWebhookConfiguration / MutatingWebhookConfiguration resource has at least one of the annotations werf.io/weight or werf.io/deploy-dependency. If neither annotation is present — error.
• Resource discovery: iterates GetStorage(), filters by kind ValidatingWebhookConfiguration or MutatingWebhookConfiguration. Non-webhook resources are skipped.
• Annotation check: accesses object.Unstructured.GetAnnotations() directly on the unstructured object. Presence of either werf.io/weight or werf.io/deploy-dependency satisfies the rule.
• Error context: each error is tied to the specific object via errorList.WithObjectID() and the source file via errorList.WithFilePath().
• Config wiring: added WebhookConfigurationRule RuleConfig + WebhookConfiguration KindRuleExcludeList to runtime config (pkg/config.go), YAML config (pkg/config/linters_settings.go), and global overrides (pkg/config/global/global.go). Level mapping in mapTemplatesRules() and exclusion mapping in mapTemplatesExclusionsAndSettings() (internal/module/module.go).
• Registration: NewWebhookConfigurationRule(...).ValidateWebhookConfigurationAnnotations(...) call added to the Run() method of the templates linter (templates.go).
• Tests: 8 test scenarios covering both annotations present, only weight, only deploy-dependency, neither annotation, MutatingWebhookConfiguration, skipping non-webhook kinds, excluded resource, excluded resource not affecting others.

Context

Without werf.io/weight or werf.io/deploy-dependency annotations, webhook configurations may deploy in an undefined order or without proper dependency ordering. These annotations control werf's deploy sequencing: werf.io/weight sets explicit ordering priority, while werf.io/deploy-dependency declares a dependency on another resource. The rule ensures that every webhook configuration explicitly declares its place in the deploy order.

Example

ValidatingWebhookConfiguration without annotations:

apiVersion: admissionregistration.k8s.io/v1
kind: ValidatingWebhookConfiguration
metadata:
  name: my-webhook
webhooks:
  - name: check.example.com
    ...

Result: error — ValidatingWebhookConfiguration "my-webhook" must have either "werf.io/weight" or "werf.io/deploy-dependency" annotation.

Fixed version:

apiVersion: admissionregistration.k8s.io/v1
kind: ValidatingWebhookConfiguration
metadata:
  name: my-webhook
  annotations:
    werf.io/weight: "10"
webhooks:
  - name: check.example.com
    ...

Excluding resources

Per-resource exclusion via KindRuleExclude (kind + name). Disable the rule entirely by setting impact to ignored.

linters-settings:
  templates:
    rules:
      webhook-configuration-annotations:
        impact: error                      # error (default) | warn | ignored
    exclude-rules:
      webhook-configuration-annotations:
        - kind: ValidatingWebhookConfiguration
          name: istio-sidecar-injector     # managed externally, no werf annotations
        - kind: MutatingWebhookConfiguration
          name: cert-manager-webhook       # managed by cert-manager operator