This patch moves from labelSelectors to matchExpressions since they are
immune to kustomize commonLabels, which prevents them from being
overwritten by accident.

References:
https://github.com/kubernetes-sigs/kustomize/issues/157
https://github.com/kubernetes-sigs/kustomize/issues/1009

Renovate has made a lot of progress in predefined configs over the past
few years this patch revisits the current config and extends it with the
usage of new presets.

This patch adds `automountServiceAccountToken: false` to various
ServiceAccount objects in order to disable automatic mounting of service
accounts tokens to Pods that never need to use them.

nginx counts parallel requests in HTTP/2 and HTTP/3 as connections.

This patch updates the limits after checking nginx logs to see that the
previously configured limits are exceeded by 100 times.