kapp reports incorrect diff for a resource having no annotation and spec updated by a webhook

**What steps did you take:**
[A clear and concise description steps and any files that can be used to reproduce the problem.]
I deployed a package install resource with below yaml
```
---
apiVersion: packaging.carvel.dev/v1alpha1
kind: PackageInstall
metadata:
name: pkg-demo
spec:
packageRef:
refName: simple-app.corp.com
versionSelection:
constraints: 1.0.1
values:
- secretRef:
name: pkg-demo-values
```

A webhook adds below fields in the resources
```
spec.defaultNamespace: some-namespace
spec.serviceAccountName: some-sa
```

**What happened:**

When I deploy the same file again, kapp reports the fields added by webhook in the diff
```
Target cluster 'https://pni-stable.stacks.bluesky.tmc-dev.cloud.vmware.com/org/7b5a3524-a142-468e-98e5-9044ec534643/project/997b9b08-6baa-4224-85ff-f36fb7da6660/clustergroup/test-run'

@@ update packageinstall/pkg-demo (packaging.carvel.dev/v1alpha1) namespace: default @@
...
spec:
- defaultNamespace: unusable-namespace
packageRef:
refName: simple-app.corp.com
...
constraints: 1.0.1
- serviceAccountName: pkg-installs-sa
values:
- secretRef:

Changes

Namespace Name Kind Age Op Op st. Wait to Rs Ri
default pkg-demo PackageInstall 11s update - reconcile ongoing Waiting for generation 1 to be
observed

Op: 0 create, 0 delete, 1 update, 0 noop, 0 exists
Wait to: 1 reconcile, 0 delete, 0 noop
```

**What did you expect:**
kapp should not report any diff for fields added by a webhook since there is no change in the resource.

**Anything else you would like to add:**
[Additional information that will assist in solving the issue.]

**Environment:**

- kapp version (use `kapp --version`):
kapp version 0.59.0

- OS (e.g. from `/etc/os-release`):
mac os
- Kubernetes version (use `kubectl version`)

---
Vote on this request

This is an invitation to the community to vote on issues, to help us prioritize our backlog. Use the "smiley face" up to the right of this comment to vote.

👍 "I would like to see this addressed as soon as possible"
👎 "There are other more important things to focus on right now"

We are also happy to receive and review Pull Requests if you want to help working on this issue.

Reproduce the report with the PackageInstall YAML and webhook-added spec fields, then trace kapp's resource diff handling for why those fields are treated as changes. Add a regression test covering a resource with no annotation and webhook-updated spec, and verify kapp reports no update diff when the submitted resource is unchanged.

Written by the indexing model from the issue text.