Create a Kyverno mutate policy to add a default resource limits sidecar annotation to Deployments

Steps

1. Author a `ClusterPolicy` (or `MutatingPolicy` if using Kyverno 1.17+ CEL APIs) with `spec.rules[].mutate.patchStrategicMerge` targeting `Deployment` resources in all namespaces.
2. Use a `patchStrategicMerge` patch or a `foreach` loop with `patchesJson6902` to add annotations or inject default resource limits when they are absent.
3. Set `spec.rules[].match.any[].resources.kinds: [Deployment]` and `spec.rules[].mutate.patchStrategicMerge` to add the annotation key conditionally using `+(key): value` syntax (the `+` prefix is a Kyverno strategic merge addition anchor).
4. Test the mutation locally with `kyverno apply policy.yaml --resource deployment.yaml` and inspect the mutated output.
5. Deploy the policy to the cluster and verify by creating a test Deployment without the target annotation; `kubectl describe` should show the annotation injected by Kyverno.
6. Use `spec.failureAction` is not applicable for mutate rules; ensure the admission webhook is healthy by checking Kyverno pod logs.