Optional strict checking mode for known GVKs in PodSet inference

[dgrove-oss]

This is a follow on from #65.

Since we can only infer/validate PodSets for known GVKs, there may be some scenarios in which we want a strict mode where we would reject all AppWrappers that contain GVKs that aren't known to the operator.

This would mostly be for user experience and better error messages. The RBACs for the operator will prevent us from actually creating instances of unexpected GVKs, so this would just move the error from when resources are created during the Resuming phase of the AppWrapper to when the AppWrapper is initially created/validated by the WebHook.