admission-aws: Adapt Secrets webhook to rely on the provider label

[ialidzhikov]

/area robustness
/area cost
/kind enhancement
/platform aws

What this PR does / why we need it:
This PR:

• Adapts the Secrets webhook to rely on the provider label (similar to admission-gcp: Adapt Secrets webhook to rely on the provider label gardener-extension-provider-gcp#396). With this the Secrets webhook:
  1. no longer intercepts every Secret UPDATE request but only requests for Secrets with label provider.shoot.gardener.cloud/aws="true"
  2. no longer needs to list Shoots (hence, no longer has a cache for Shoots based on Informers) to understand whether a Secret is in-use by a Shoot from the same provider type ("aws")
• Adds a new SecretBinding webhook (similar to admission-gcp: Add SecretBinding validator gardener-extension-provider-gcp#428). This is to prevent creating SecretBindings that refer Secret from wrong provider type and hence block update request for this Secret as the admission will fail because the Secret does not contain valid credentials.

Which issue(s) this PR fixes:
Part of gardener/gardener-extension-provider-gcp#143 but for admission-aws

Release note:

This version of admission-aws requires the SecretBinding provider controller to be enabled - enabled by default for gardener-controller-manager >= 1.42 or can be enabled via the gardener-controller-manager component config.

The Secrets webhook of admission-aws:
- no longer intercepts every Secret UPDATE request but only requests for Secrets that are associated with a SecretBinding with `provider.type=aws`.
- no longer needs to list Shoots (hence, no cache for Shoots)

The admission-aws component introduces a new SecretBinding validator. It validates requests for SecretBindings and checks whether the SecretBinding refers to a valid AWS Secret.

[rfranzke]

/lgtm