Add an example Kyverno policy that injects the entrypoint

[busser]

We have long-term plans for a Kubernetes mutating webhook that injects the entrypoint into pods. A quick win would be to provide a Kyverno policy that does just that.