rancher-webhook is not ha in workload-clusters

Summary

In !1783 (merged), we've introduced a kyverno policy that ensures ha for rancher-webhook pods.

Unfortunately, as this policy is installed with rancher, it won't be installed in workload clusters, we should remediate to that issue.