Add AWS validator for core resources

[timuthy]

What this PR does / why we need it:
This PR adds a validating webhook that is responsible for checking resources of the group core.gardener.cloud (at the moment only shoot resources).

With GEP-4 cloud specific information was externalized and as a consequence cannot be validated by the Gardener anymore. On the other hand, it should be prevented that invalid shoot objects are created or updated.

Example:

apiVersion: core.gardener.cloud/v1alpha1
kind: Shoot
...
spec:
...
  provider:
    type: aws
    infrastructureConfig:
      apiVersion: aws.provider.extensions.gardener.cloud/v1alpha1
      kind: InfrastructureConfig
      networks:
        vpc:
          cidr: 10.251.0.0/16
        zones:
        - internal: 10.251.112.0/22
          name: eu-west-1a
          public: 10.251.96.0/22
          workers: 10.251.0.0/19
    workers:
      ...
      zones:
      - eu-west-1c

The above example is supposed to be denied because a worker group refers to an availability zone (eu-west-1c) which is not part of the InfrastructureConfig.

Since the gardener-extensions repository is already a home for cloud specific logic, this PR adds cloud specific validations for core resources to this repo.

Part of #407

Special notes for your reviewer:
Validations for other cloud providers will follow.

Release note:

The `gardener-extensions` now offers a validating webhook which checks shoot resources of type `aws` in the recently introduced `core.gardener.cloud` group. Operators should register this webhook in the Garden cluster to further prevent invalid modifications on `aws` shoots.

[timuthy]

Please do not merge since I'm also changing the ValidateInfrastructureConfigUpdate to allow zones to be added.
See gardener/gardener#1587
/cc @zanetworker

[timuthy]

The validation logic which allows to add availability zones has been added.

I dropped the restriction that the zone order must be retained because in the new API group you cannot mix the networks and the names anymore. Furthermore I noticed that in the old API it's possible to configure the exact same zone multiple times with different networks which doesn't make any sense, right @zanetworker @rfranzke ?

[timuthy]

@rfranzke, @zanetworker, @tim-ebert thanks for your reviews.

I addressed your comments, PTAL.

[zanetworker]

Looks good :) just a couple of small comments.

[ialidzhikov]

Is it delegated to g/garden-setup to install the validator charts?

[rfranzke]

The responsible party that creates the ControllerRegistration for the extension controller will also do deploy the extension validator charts.

[timuthy]

@rfranzke could you please have another look?

[rfranzke]

/lgtm (just a few minor suggestions :))

[rfranzke]

/lgtm, nice work!