Support declarative API for validation rules for external admission checks

[mimowo]

What would you like to be added:

We already have two validation rules for admission checks, used for the built-in ones:

• SingleInstance - means that only one instance of the AdmissionCheck can be specified for CQ
• FlavorIndependent - meaning that the AdmissionCheck can only be specified at the CQ level

Both of them are used currently for MultiKueue only.

Why is this needed:

To provide declarative validation of the AdmissionCheck configuration for the external AdmissionChecks.

This is a spin off from the discussion under #3094.

Completion requirements:

This enhancement requires the following artifacts:

• Design doc
• API change
• Docs update

The artifacts should be linked in subsequent comments.