Shield coordination: supersede Kyverno default-deny generate policy

[weatherhog]

Part of #4338.

• Agree with Shield to deprecate add-default-deny-network-policy in giantswarm/kyverno-policies (opt-in, NetworkPolicy-only, no exclusions/opt-out, enabled nowhere) as superseded by network-policies-app
• Update giantswarm/giantswarm#36605 and reference lineage (giantswarm/giantswarm#27648, giantswarm/giantswarm#32598)