Configure OPA Gatekeeper mutation with Assign and AssignMetadata to automatically add default labels to pods

Steps

1. Enable the Gatekeeper mutation feature by setting --enable-mutation in the Gatekeeper controller manager arguments or via the Helm chart value; restart the controller after enabling.
2. Write an AssignMetadata manifest to inject a specific label into every pod's metadata.labels using spec.match to scope it by namespace or resource kind.
3. Write an Assign manifest to inject a value into a non-metadata field (e.g., spec.containers[].securityContext.readOnlyRootFilesystem) using a location path and spec.parameters.
4. Apply both mutation CRDs and create a test pod to verify the label and field are injected; describe the pod and inspect its metadata.
5. Check for mutation conflicts: if two Assign objects target the same path, Gatekeeper resolves them by applying all matching mutations and a conflict will cause neither to apply; audit the MutationStatus.