Investigate use of MutatingAdmisionPolicy instead of webhooks

[tmshort]

This might be a simpler approach (alpha in 1.30):

https://github.com/kubernetes/enhancements/tree/master/keps/sig-api-machinery/3962-mutating-admission-policies#use-case-set-a-label

[tmshort]

Not available in kind v0.24.0 (which supposedly uses k8s v1.31.0)