Have the MCO manage and render the current list of cluster-default policies into the object's spec

Also have either a validation webhook prevent user tampering of this spec, or have the MCO overwrite any changes the user makes