Wildcards in match / exclude statements should be invalid

[chipzoller]

If we're not going to support wildcards (*) in match / exclude statements, then Kyverno needs to detect them and reject the policy as being invalid.

[hans-d]

a way to specify ALL kinds, or not being forced to specify at least 1 kind would be good imho.

Eg:

• All resources created by role X should have label Y=Z.
• In the case of cli usage only, I want to validate that no resource has a label A=B

[JimBugwadia]

See: #1954 and #1981.

Its possible to support an "all kinds", and there seem to be some good use cases for that, but as discussed in the referenced issues there are feature and performance tradeoffs we will need to navigate carefully.