[admission-policy-engine] advanced operation policies

Preflight Checklist

• I agree to follow the Code of Conduct that this project adheres to.
• I have searched the issue tracker for an issue that matches the one I want to file, without success.

Use case. Why is this important?

After #3131 issue we have a few policies left:

1. PortRange - find intersection between service ports and busy node ports
2. RoleBinding to the absent ServiceAccount
3. Deployment/DaemonSet/StatefulSet has no VPA defined
4. no PDB set

all these checks are hard to implement because they are dependent on foreign objects. For example, if you are deploying Deployment + VPA, Deployment will be deployed first and validation webhook will forbid it because VPA does not exist yet.

Proposed Solution

Maybe we should not have the validation webhook for these checks. And just check them in the cluster via OPA audit deployment

Additional Information

No response

Start by reading the admission-policy-engine implementation and the work from issue #3131, then compare the four proposed checks: PortRange, missing ServiceAccount RoleBinding, absent VPA, and missing PDB. Determine whether these checks belong in a validation webhook or an OPA audit deployment, and define completion as a reviewed approach that handles dependencies between foreign objects.