fix: Filter patches to drop "remove" operation to prevent dropping unknown fields

[aramase]

Reason for Change:

Filter patches to only allow "add" operation to prevent dropping unknown fields

Issue Fixed:

fixes #1312

[codecov-commenter]

Codecov Report

Attention: Patch coverage is 40.00000% with 3 lines in your changes are missing coverage. Please review.

Project coverage is 52.85%. Comparing base (3874533) to head (cc3c97a).
Report is 6 commits behind head on main.

Files	Patch %	Lines
pkg/webhook/webhook.go	40.00%	2 Missing and 1 partial ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #1333      +/-   ##
==========================================
+ Coverage   51.66%   52.85%   +1.18%     
==========================================
  Files          53       53              
  Lines        2938     2433     -505     
==========================================
- Hits         1518     1286     -232     
+ Misses       1378     1104     -274     
- Partials       42       43       +1     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

[enj]

This commented out approach seems safer? And maybe invert the check so we only keep the type of operations we understand?

[enj]

I haven't seen any other webhook use this approach, so it makes me nervous that it won't work correctly in all cases.

[enj]

Also add tests where we fabricate fields that will never exist at different nesting levels that don't exist anywhere in corev1.Pod. Like pod.Panda or pod.Spec.Panda or pod.Spec.Jungle.Panda.

[aramase]

Closing this PR after further testing.

In e2e tests we create a pod with init container and test injecting sidecar proxy. The sidecar is added as the first container in the list so it's started first and the way patches get generated instead of doing a complete replace of
/spec/containers/0, it does replace and remove on individual fields (which is expected)

{replace /spec/containers/0/name azwi-proxy}
{replace /spec/containers/0/image aramase/proxy:add_op_00}
{add /spec/containers/0/ports [map[containerPort:8080]]}
{add /spec/containers/0/securityContext/privileged false}
{replace /spec/containers/0/securityContext/runAsNonRoot true}
{add /spec/containers/0/securityContext/readOnlyRootFilesystem true}
{remove /spec/containers/0/securityContext/seccompProfile <nil>}
{remove /spec/containers/0/securityContext/runAsUser <nil>}
{remove /spec/containers/0/args/2 <nil>}
{replace /spec/containers/0/args/1 --log-level=info}
{replace /spec/containers/0/args/0 --proxy-port=8080}

if we skip "remove" operation, it breaks because the args and other fields incorrectly remain.

1. The k8s version bump will resolve the current issue with Kubernetes native sidecar fields.
2. I've opened Generating generic patches for only the required changes #1337 for us to investigate further.