[TASK] Reject orphan deletes of Workspace resources via webhook

### Certification

- [x] I certify I am an Epic Owner for Kubeflow Notebooks 2.0 and expected to create planning-related issues.

### Description

Add validation to the Workspace mutating/validating webhook to reject any update that adds the
`orphan` deletion propagation policy. This prevents users from deleting a Workspace while leaving
its owned resources (StatefulSet, Service, VirtualService) running in the cluster.

Kubernetes supports orphan deletion via two mechanisms:
- Setting `metadata.finalizers` to include `orphan`
- Passing `propagationPolicy=Orphan` in the delete request

The webhook should reject updates that add the `orphan` finalizer. The delete-request propagation
policy may need a separate mechanism (validating admission on DELETE) — the implementer should
investigate which approach fully closes the orphan delete path and document any limitations.

#### Goals

- Webhook validation logic in `internal/webhook/workspace_webhook.go`
- Reject updates that add an `orphan` finalizer to a Workspace
- Clear error message explaining why orphan deletion is not permitted
- Unit tests for the validation logic
- Investigate whether the `propagationPolicy=Orphan` delete-request path also needs coverage

#### Key Files

| File | Changes |
|------|---------|
| `workspaces/controller/internal/webhook/workspace_webhook.go` | Add orphan finalizer rejection |

#### Reference

- Kubernetes orphan deletion: https://kubernetes.io/docs/tasks/administer-cluster/use-cascading-deletion/#set-orphan-deletion-policy

### Acceptance Criteria

- [ ] Workspace update that adds an `orphan` finalizer is rejected by the webhook
- [ ] Error message clearly explains that orphan deletion is not permitted for Workspaces
- [ ] Existing legitimate finalizers (e.g., WorkspaceKind finalizer) are not affected
- [ ] Unit tests cover: orphan finalizer rejected, non-orphan finalizer allowed, update without
finalizer change allowed