Since kube-system is a bit delicate when it comes to blocking, this
intial network policy tries to not block anything in order to keep
everything working. This might be the solution to the
globalnetworkpolicy issue.

This patch adds a new network policy to allow traffic from the
monitoring namespace to access the exporter endpoints. Since it's not
using allow right now, prometheus reports target down.

The template still contained a wrong namespace name which was a copied
from a policy template. Since the switch to a simple shared document the
namespace name is filled in by kustomize instead and therefore has to be
removed from the shared file.