As a user, I want CCO to configure its network policies so I can enable a default deny all rule.

Add network policies that enable required access to and from each CCO pod including the operator and pod identity webhooks.

service/controller-manager-service: 443
service/cco-metrics: metrics/8443
service/pod-identity-webhook: 9443

pod/kube-rbac-proxy: metrics/8443
pod/cloud-credential-operator: none
pod/pod-identity-webhook: 443