Ensure 4xx+ response codes from webhook rejections

[liggitt]

What type of PR is this?
/kind bug

What this PR does / why we need it:
Admission webhooks can unintentionally reject requests while still returning a 200 status to the user.

This causes things like kubectl create to return a 0 status when their request was actually rejected.

Webhook dispatch should force rejections to have >= 400 http status codes.

Special notes for your reviewer:
xref #76984

Does this PR introduce a user-facing change?:

API requests rejected by admission webhooks which specify an http status code < 400 are now assigned a 400 status code.

[k8s-ci-robot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: liggitt

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• staging/src/k8s.io/apiserver/OWNERS [liggitt]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[liggitt]

/cc @brendandburns

[liggitt]

/cc @caesarxuchao

[liggitt]

We talked about switching this to a 500 in the api-machinery call today, but the more I consider this, I think that would be misleading to the end user. The reason their request was rejected was because their request was judged to be bad, not because the server had some error.

I see this as akin to what we do here:

kubernetes/staging/src/k8s.io/apiserver/pkg/endpoints/handlers/responsewriters/writers.go

Lines 119 to 126 in 7289c1e

	_, serializer, err := negotiation.NegotiateOutputMediaType(req, s, restrictions)
	if err != nil {
	// if original statusCode was not successful we need to return the original error
	// we cannot hide it behind negotiation problems
	if statusCode < http.StatusOK || statusCode >= http.StatusBadRequest {
	WriteRawJSON(int(statusCode), object, w)
	return
	}

if we encounter a negotiation error in the process of trying to write an error response, we don't switch to a 500, we preserve the original error code

[logicalhan]

I personally find that argument compelling.

[caesarxuchao]

/lgtm