This patch adjusts the central oauth2-proxy resource to use
`topologySpreadConstraints` instead of using `podAntiAffinity`. This
helps with reducing the risk of Pending Pods e.g. during updates when
also a pod config is adjusted.

This patch should make redis HA, which should eliminate another SPOF for
goharbor. This is the first usage for the new redis operator.

This patch provides an initial version of shields for the
cluster, deploying shields in a fairly locked down setup. This
includes blocking all ingress and egress traffic except of the
ingress controller, monitoring and outgoing web traffic to the
public internet.

As part of this some new shared network policies are created,
added and renamed. These aim to improve the namespace isolation
and provisioning of controlled network access.

This patch provides a new shared-config that can be used to allow access
from kube-system and uses this NetworkPolicy to allow access to the new
metallb AdmissionWebhook.

Add a very basic, shared policy to prevent ingress traffic for a
namespace.

This patch allows to monitor Postgresql Instances by allowing the
monitoring namespace to access a exporter container port by default for
spilo instances.

This patch reduces the network acess from the database mangeement
namespace to postgres-operator only. (Technically speaking there isn't
anything else running in that namespace, but it helps to keep things
tight in case of future expansions.)

This patch reduces the network access from the monitoring namespaces to
only prometheus.

This patch should help to better scale software on the cluster, CPU
limits are not that big of a problem.