This patch makes sure that a PostgreSQL cluster doesn't end up on a single
node. This is done by defaulting to a pod anti-affinity based on the
kubernetes hostname label, that should make sure, that all stateful sets
are distributed properly.

This patch fulfils the previous's promises and puts the right port
string in place. 

This patch puts the port definitions into the right place and uses the
key `port` instead of `containerPort` as expected by NetworkPolicy
objects.

This patch thightens up the network policy that is deployed to all
namespaces, to limit access to the postgres-operator managed pods.

This patch enables read-only filesystems and no-new-privileges for all
postgres databases managed by the zalando postgres operator.

This patch should allow to automate network policies better, by adding a
label with the namespace name to the postgres namespace

This patch enables the namespace-configuration-operator, which allows
to deploy object template into all namespaces matching a selector,
making it very useful for management of basic namespace infrastructure.
It also enforces the existence of these objects.