Write an OPA Rego policy package to require specific labels and block images from disallowed registries, then unit-test it with opa test

Steps

1. Define a Rego package with two rule sets: one using deny or violation rules that fail when required label keys are absent from input.review.object.metadata.labels, and one that fails when any container image prefix is not in an allowed registries list.
2. Parameterize the allowed registries and required labels as constants or input data so the policy can be reused across environments without editing Rego source.
3. Write a _test.rego file in the same package using test_ prefixed rules; provide mock input objects that cover compliant and non-compliant cases for both rule sets.
4. Run opa test ./policies/ to execute unit tests; add --coverage to measure which rules are exercised.
5. Integrate opa test in CI so failures block the pipeline before the policy is published to a bundle or Gatekeeper.