feat: expose reinvocationPolicy on kubernetesMutating bindings

[marxus]

Overview

Wire reinvocationPolicy from admissionregistration.k8s.io/v1 MutatingWebhook through hook config, so hook authors can opt into IfNeeded when their mutation depends on the object state after other mutators run.

What this PR does / why we need it

PR #439 landed mutating-webhook support but did not surface the reinvocationPolicy knob. Without it, every mutating hook registered via shell-operator gets the API server default (Never), and there's no config-level way to change that — you'd have to hand-patch the generated MutatingWebhookConfiguration.

This adds an optional reinvocationPolicy: Never|IfNeeded field on kubernetesMutating entries and maps it into v1.MutatingWebhook.ReinvocationPolicy. When unset the field stays nil, so the API server keeps owning the default (no behavior change for existing hooks).

Example:

configVersion: v1
kubernetesMutating:
- name: default-replicas.example.com
  reinvocationPolicy: IfNeeded
  rules:
  - operations: ["CREATE"]
    apiGroups:    ["stable.example.com"]
    apiVersions:  ["v1"]
    resources:    ["crontabs"]

Changes:

• pkg/hook/config/config_v1.go — new ReinvocationPolicy *v1.ReinvocationPolicyType on KubernetesAdmissionConfigV1; passed through in convertMutating.
• pkg/hook/config/schemas.go — reinvocationPolicy enum added under kubernetesMutating only. The knob does not exist on ValidatingWebhook (validating webhooks run once, after all mutations), and additionalProperties: false already rejects it on kubernetesValidating.
• pkg/hook/config/config_test.go — three cases: pass-through (IfNeeded and unset), invalid enum rejected, and rejection on kubernetesValidating.

Docs are not touched — there is no BINDING_MUTATING.md in the repo yet (the mutating example already references a missing file); that gap is out of scope here.

Does this PR introduce a user-facing change?

Add `reinvocationPolicy` field on `kubernetesMutating` hook bindings to control MutatingWebhook reinvocation.