WebhookResponse assembles an allowed or denied admission response with the same UID as the provided request.

PrivilegedServiceAccountGroups is a regex string of serviceaccounts that our webhooks should commonly allow to perform restricted actions.