Adding a Kubernetes validating webhook will enable the Quay Operator to reject QuayRegistries which reference a spec.configBundleSecret which does not exist or is invalid in some way.

This will also pave the way for a mutating admission webhook, which could be used to fill in default values (instead of adding an extra reconcile loop like we currently do).