Isolation: network policy automatic addition

[galal-hussein]

Currently none of the workloads generated within a k3k cluster can reach other pods in a different k3k cluster which is the correct behavior, however the pods still can reach the host's cluster network, the controller should automatically add a layer of isolation on the k3k cluster pods, for example by setting a network policy on the cluster's namespace so that it can't reach any other pods on the host's clusters