Implement a validating webhook server.

[jmalloc]

There doesn't appear to be a way to represent a oneOf: [type: boolean, type: string] in the CRD and still remain a "structural" spec according to K8s subset of support for OpenAPI v3.

A validating webhook server would let us keep the current attribute format (current as of v0.3.0) and still prevent the user from defining invalid attribute values.