change kube-webhook create/patch to runAsUser: distroless

explicitly run as 65532 (distroless nonroot user) so kube-webhook works on selinux enforcing systems that don't allow root elevation