cleanup: replace some Kyverno policies introduced during 1.2 cycle with ValidatingAdmissionPolicies

We've introduced in Sylva 1.2 many Kyverno policies (in particular to control what RKE2 controllers do), and some of them would be much easier to implement using ValidatingAdmissionPolicies.

Depends on having ValidatingAdmissionPolicy feature gate enabled (was done in !3349 (merged))

/cc @feleouet