add validating webhook for studyJob

[hougangliu]

If create/update a studyJob with bad CR manifest or invalid configuration, k8s api
server will reject the request.
Fixes: #314

---

This change is 

[hougangliu]

/assign @YujiOshima @richardsliu @johnugeorge @gaocegege

[hougangliu]

/retest

[richardsliu]

@hougangliu Does this require any specific version of k8s server to work?

[hougangliu]

api admission webhook introduced in k8s 1.9

[johnugeorge]

In operators, job goes into failed state when the config is invalid. What is the recommended way?

[hougangliu]

when we submit a invalid k8s resource(saying deployment), API server reject it. so I think we'd better follow k8s way

[johnugeorge]

I was thinking about the consistency across kubeflow components.

There are few pre requisites for API servers. https://kubernetes.io/docs/reference/access-authn-authz/admission-controllers/#is-there-a-recommended-set-of-admission-controllers-to-use I am not sure if admission plugins are enabled by default for api servers across clouds.
https://istio.io/help/ops/setup/webhook/#verify-dynamic-admission-webhook-prerequisites

[hougangliu]

In k8s official doc, ValidatingAdmissionWebhook is in recommended set of admission controllers to use and enabled by default.

[hougangliu]

in 1.9, ValidatingAdmissionWebhook is RecommendedPlugin. After 1.10, it is enabled by default.

[johnugeorge]

Sounds good. Can you add a test too?

[hougangliu]

Sounds good. Can you add a test too?

sure, done! thanks!

[johnugeorge]

/lgtm
I will wait for @richardsliu

[richardsliu]

/lgtm
/approve

[k8s-ci-robot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: richardsliu

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [richardsliu]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment