Validate objects during Apply in a synchronous manner - using Validating Admission Webhook?

**Description**:
>Describe the desired behavior, what scenario it enables and how it
would be used.

Currently when we do `kebectl apply`, the only validation is structural at that point.

There is then an async cycle of reconciliation with validation.

This has obvious issues:

* Need to check each object's status after apply. Just because `apply` succeeded doesn't mean it worked!

* Can break the everything in Envoy Gateway as per these issues:
* [LUA scripts in EnvoyExtensionPolicy failing validation causes all routes to return direct_response with 500 status #6942](https://github.com/envoyproxy/gateway/issues/6942)
* [Return 500 when xPolicy translation fails #3873](https://github.com/envoyproxy/gateway/issues/3873)

What would be better is some *eager* synchronous validation during the apply:
* If object is invalid for some reason, `apply` fails right there
* If `apply` succeeded, it's guaranteed that the object will be in `Accepted` state.

My understanding is this might be achieved using Validating Admission Webhook but I'm not a specialist in this field so maybe I'm entirely wrong :), but I think Cert Manager implements this.