This patch removes the no longer needed encryption regex from the sops
configuration. This regex was introduced when using the values field to
set certain URLs in the oauth2-proxy config. Since this was replaced
with secret-based config overwrites as part of the helmrelease, the
regex can safely be dropped.

This patch introduces a new component that can be used to restrict all
ingress resources to a predefined set of whitelisted IP addresses. This
reduces the duplication in ingress objects for the same rule sets over
and over again.

This patch adjusts the component for oauth2-proxy to also include a
patching mechism for all kustomize-defined Ingress objects to be
restricted.

The first patch that "adds" `{}` to `/metadata/labels` would replace any
existing labels resulting in unexpected behaviour. Instead we rely on
the preexistence of the labels field in the namespace.

This patch drops commonLabels since the helm chart from forecastle won't
be compatible with the resulting network policies

This patch moves from labelSelectors to matchExpressions since they are
immune to kustomize commonLabels, which prevents them from being
overwritten by accident.

References:
https://github.com/kubernetes-sigs/kustomize/issues/157
https://github.com/kubernetes-sigs/kustomize/issues/1009

Renovate has made a lot of progress in predefined configs over the past
few years this patch revisits the current config and extends it with the
usage of new presets.