The first patch that "adds" `{}` to `/metadata/labels` would replace any
existing labels resulting in unexpected behaviour. Instead we rely on
the preexistence of the labels field in the namespace.

This patch drops commonLabels since the helm chart from forecastle won't
be compatible with the resulting network policies

This patch moves from labelSelectors to matchExpressions since they are
immune to kustomize commonLabels, which prevents them from being
overwritten by accident.

References:
https://github.com/kubernetes-sigs/kustomize/issues/157
https://github.com/kubernetes-sigs/kustomize/issues/1009

Renovate has made a lot of progress in predefined configs over the past
few years this patch revisits the current config and extends it with the
usage of new presets.

This patch adds `automountServiceAccountToken: false` to various
ServiceAccount objects in order to disable automatic mounting of service
accounts tokens to Pods that never need to use them.