Include validation in webhook

**What would you like to be added**:

Include validation logic to ensure role exists, and that the trust policy is valid.

**Why is this needed**:

Currently validation never happens and workloads only fail once they try to access an AWS service and fail.

Ideally this feature could somehow be disabled for folks who would rather not have validation at creation time.

No files, tests, or entry points are named. Start by locating the webhook creation path and how it currently handles AWS roles, then trace what validation options the project already exposes. Done means invalid roles or trust policies are caught before workloads use them, with a clear way to disable creation-time validation.

Written by the indexing model from the issue text.