network-policies-app: clusterwide default-deny, opt-out label, grandfathering

[weatherhog]

Part of #4338.

Extend giantswarm/network-policies-app (target: v1.0.0):

• New CCNP template default-deny-all-namespaces + clusterwide allow-dns, per spike results
• Values: denyByDefault.clusterWide.{enabled, optOutLabel, grandfatherExistingNamespaces} (keep existing denyByDefault.namespaces behavior untouched)
• One-shot Helm hook Job + RBAC: on first enablement, label all pre-existing non-GS namespaces policy.giantswarm.io/default-deny=false
• Tests (helm-unittest/chainsaw) + README covering opt-out and exception workflow