Add NetworkPolicy to separate user functions

[alexellis]

We need a NetworkPolicy which does the following:

• Prevent functions calling system services - block (openfaas-fn) -> (openfaas)
• Prevent functions calling other functions - block (openfaas-fn) -> (openfaas-fn)
• Allow OpenFaaS Cloud "system" functions to do the above. Use a label to decide which functions belong to this group.

In addition we will have to prevent users from adding this "system" or "openfaas" label to their functions in the buildshiprun function.

Testing:

Show above conditions are satisfied in a deployment on Kubernetes.

Changes should be made to / added to the Kubernetes YAML files in ./yaml/ and documented in the docs/README.md file.

[alexellis]

I closed the original issue from April since this has more detail.

Example policy definition:
https://github.com/stefanprodan/openfaas-flux/tree/bb69dffda2ae8cead8035eaf35c9a92cb29a2924/network-policies

[bartsmykla]

Derek assign: me