feat(controller): reject ScanJob creation when referenced Registry does not exist

[fabriziosestito]

Description

Fixes #1180

[codecov]

Codecov Report

❌ Patch coverage is 75.00000% with 3 lines in your changes missing coverage. Please review.
✅ Project coverage is 53.47%. Comparing base (4395da6) to head (fcf6fe9).
⚠️ Report is 31 commits behind head on main.

Files with missing lines	Patch %	Lines
internal/webhook/v1alpha1/scanjob_webhook.go	75.00%	2 Missing and 1 partial ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #1184      +/-   ##
==========================================
+ Coverage   53.41%   53.47%   +0.05%     
==========================================
  Files          61       61              
  Lines        5328     5339      +11     
==========================================
+ Hits         2846     2855       +9     
- Misses       2086     2087       +1     
- Partials      396      397       +1     

Flag	Coverage Δ
unit-tests	53.47% <75.00%> (+0.05%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[Copilot]

Pull request overview

This PR improves the ScanJob admission experience by rejecting ScanJob creation when the referenced Registry resource does not exist (while still leaving the controller-side guard in place to avoid TOCTOU issues), addressing #1180.

Changes:

• Switch the ScanJob webhook validator to use the manager’s API reader for read-only access.
• Add validation on ScanJob create to verify the referenced Registry exists in the same namespace and return a spec.registry “Not found” validation error otherwise.
• Extend webhook unit tests to cover the missing-Registry denial case and to create a Registry for existing “admit/deny by running job” scenarios.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.

File	Description
internal/webhook/v1alpha1/scanjob_webhook.go	Adds Registry existence validation during ScanJob creation and uses a read-only API reader.
internal/webhook/v1alpha1/scanjob_webhook_test.go	Updates/extends tests to account for the new Registry existence requirement.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.