Add `kube-system` namespace exception to all constraints that cause violations

kube-system should be in all constraints as an excluded namespace since Gatekeeper will not be able to enforce violations with every Kubernetes distribution.

I would like to see us use this approach to just exclude the namespace. We can't label the namespace (w/o a job of some type) since its created outside of BB. And, this would eliminate the problem of "forgetting" to add it in the package violation or when overriding it from Big Bang or the customer template.