HierarchyConfiguration labels/annotations should be validated on admission

[erikgb]

A new feature allowing labels/annotations to be configured in HierarchyConfiguration was introduced in #122. Both labels and annotations have quite strict validation rules in K8s. To avoid this failing on reconcile of namespaces, we should validate the new fields on admission. I think we should add at least the following validations:

• Valid label key
• Valid label value
• Valid annotation key
• Valid annotation value
• Validate that all labels are managed labels
• Validate that all annotations are managed annotations

Part of #47

/assign