Leverage Authorizer instead of Admission webhook to enforce etcd cluster resource protection

[unmarshall]

How to categorize this issue?

/area control-plane
/kind enhancement
/kind technical-debt
/kind task

What would you like to be added:
Currently etcd-druid provides protection against accidental or malicious attempts to update/delete etcd-cluster resources that are provisioned by etcd-druid for every Etcd custom resource. More details about it can be found here.

The initial implementation choice was to use Admission Webhook, more precisely validating webhook. While this serves the current purpose, it is not really a good fit semantically. Validating webhooks are usually meant to validate resources. In this webhook no validation of Etcd resource is done, instead it reacts on what kind of verb is invoked on a managed resource (by etcd-druid) and if that is authorized for that user.

This fits perfectly to an Authorizer.
Additional information: https://kubernetes.io/docs/reference/access-authn-authz/authorization/
Authorizers are called after Authentication and before invoking the Admission webhooks (ref: https://kubernetes.io/docs/concepts/security/controlling-access/)

We should change from using a validating admission webhook to an authorizer.