The constraint template library includes a new template: K8sRestrictAdmissionController

## Feature The constraint template library includes a new template: `K8sRestrictAdmissionController`. For reference, see the [Constraint template library](https://cloud.google.com/anthos-config-management/docs/latest/reference/constraint-template-library). ## Feature The constraint template library includes a new template: `K8sCronJobAllowedRepos`. For reference, see the [Constraint template library](https://cloud.google.com/anthos-config-management/docs/latest/reference/constraint-template-library). ## Feature Added the authentication type `k8sserviceaccount` for syncing from OCI images and Helm charts hosted in Artifact Registry. For more details, see [Grant Config Sync read-only access to OCI](https://cloud.google.com/anthos-config-management/docs/how-to/installing-config-sync#oci-access) and [Grant Config Sync read-only access to Helm](https://cloud.google.com/anthos-config-management/docs/how-to/installing-config-sync#helm-access). ## Feature Simplified the steps to export metrics to Cloud Monitoring. For more details, see [Configure Cloud Monitoring with Workload Identity](https://cloud.google.com/anthos-config-management/docs/how-to/monitor-config-sync-cloud-monitoring#custom-monitoring). ## Fix Fixed the unrecognized label error in the `otel-collector` configuration that caused kustomize metrics to be rejected.