Capsule regex validation flaw may cause namespace admission panic

The projectcapsule/capsule team has disclosed a medium-severity security issue, detailed in the GitHub Security Advisory database, affecting regex validation in Tenant admission. Specifically, malformed `ForbiddenAnnotations.Regex` values can bypass validation during Tenant updates. This occurs because the webhook compiles the `ForbiddenLabels.Regex` for both labels and annotations, allowing invalid regexes in the annotations field to persist. When namespace admission later evaluates the malformed regex, it triggers a panic in `regexp.MustCompile`, potentially causing denial of service for namespace operations within the affected tenant.

Operators should carefully review their Tenant specifications, particularly the `ForbiddenAnnotations.Regex` and `ForbiddenLabels.Regex` fields, before upgrading or applying changes. Any malformed regex in these fields could lead to operational disruptions. This issue highlights the importance of ensuring regex validation mechanisms are robust and distinct for different fields, as similar validation shortcuts have caused issues in other projects.