Fix misleading 'enforced by webhook' comment in MCPExternalAuthConfig

Summary

A comment on the AWS STS configuration claims validation is "enforced by webhook" but no validating webhook exists in the codebase. The enforcement is actually performed by validateAWSSts() during reconciliation. This is misleading for developers and contributors.

Severity: SHOULD FIX
Area: Code Accuracy
Breaking: No

Location

• cmd/thv-operator/api/v1alpha1/mcpexternalauthconfig_types.go:622

Problem

// At least one of FallbackRoleArn or RoleMappings must be configured
// (enforced by webhook)

The project uses a CEL + reconciler validation model (no webhooks). This comment is either a leftover from a planned-but-unimplemented webhook or was written inaccurately.

Impact

• Misleading for developers who may search for a webhook implementation
• Contributors may believe a webhook exists and skip adding CEL validation because they think the webhook handles it
• Inaccurate documentation of the validation architecture

Recommended Fix

Update the comment to reflect the actual enforcement mechanism:

// At least one of FallbackRoleArn or RoleMappings must be configured
// (enforced during reconciliation by validateAWSSts).

Optionally, also add a CEL rule to enforce this at admission time:

// +kubebuilder:validation:XValidation:rule=
//   "has(self.fallbackRoleArn) || (has(self.roleMappings) &&
//    size(self.roleMappings) > 0)",
//   message="at least one of fallbackRoleArn or roleMappings is required"

Open cmd/thv-operator/api/v1alpha1/mcpexternalauthconfig_types.go at line 622 and inspect the surrounding MCPExternalAuthConfig definition. Confirm that validateAWSSts() performs the enforcement during reconciliation, then update the misleading webhook comment so it accurately describes that mechanism.