Currently the operator-policy-controller is only started in the config-policy-controller container if a certain flag is present. This was helpful during the initial prototype stages, because it ensured that bugs in the prototype would not affect the other running controllers in our tests.

The controller now needs to be on by default. Users will still "opt-in" to this feature by creating an OperatorPolicy, but they will not need to set additional flags in order to do that.

This task will also include bringing the required CRD into the policy addon controller, so that it is distributed to managed clusters.