feat(webhook): report validation failures as structured field errors

[rjgoyln]

Summary

Webhook validators currently reject invalid resources with hand-written error messages that do not identify the offending field. As a result, kubectl prints an opaque error and clients cannot determine which part of the spec needs to be fixed.

Emitting k8s.io/apimachinery field errors allows the API server to return structured, per-field validation causes.

Closes #3131.

Change

• Validators now return field.ErrorList, which is wrapped with apierrors.NewInvalid at the admission entry points.
• SparkConfKeyDeniedError is replaced with field.Forbidden on the offending spec.sparkConf key.
• An exhausted ResourceQuota is returned with NewForbidden, while a failed quota lookup is returned with NewInternalError, since neither represents an invalid field.

Fail-fast behavior is preserved, so causes normally contains one entry; error aggregation is tracked separately in #3133.

SparkApplication still does not validate spec.driver.memory or spec.executor.memory, so an unparseable value is not reported with a field path. Adding this validation would reject specs that are currently accepted, so it is left for a follow-up.

Behavior change

Validation rejections that identify a bad field now return 422 Invalid with per-field details.causes. Previously, all webhook rejections were returned as 403 Forbidden with a single error message.

An exhausted ResourceQuota remains 403 Forbidden.

Change Category

• Bugfix (non-breaking change which fixes an issue)
• Feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that could affect existing functionality)
• Documentation update

Checklist

• I have conducted a self-review of my own code.
• I have updated documentation accordingly.
• I have added tests that prove my changes are effective or that my feature works.
• Existing unit tests pass locally with my changes.

---

🤖 Generated with Claude Code

[google-oss-prow]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign mwielgus for approval. For more information see the Kubernetes Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[github-actions]

🎉 Welcome to the Kubeflow Spark Operator! 🎉

Thanks for opening your first PR! We're happy to have you as part of our community 🚀

Here's what happens next:

• If you haven't already, please check out our Contributing Guide for repo-specific guidelines and the Kubeflow Contributor Guide for general community standards.
• Our team will review your PR soon!

Join the community:

• Slack: Join our #kubeflow-spark-on-kubernetes Slack channel.

Feel free to ask questions in the comments if you need any help or clarification!
Thanks again for contributing to Kubeflow! 🙏

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[tariq-hasan]

/ok-to-test
/retest