Tenant owner is unable to label namespaces

[MaxFedotov]

Having the following tenant spec

kubectl create -f - << EOF
apiVersion: capsule.clastix.io/v1beta1
kind: Tenant
metadata:
  annotations:
    capsule.clastix.io/forbidden-namespace-labels-regexp: pod-security.kubernetes.io.*
  name: foo
spec:
  namespaceOptions:
    additionalMetadata:
      labels:
        capsule.clastix.io/tenant: foo
        pod-security.kubernetes.io/audit: restricted
        pod-security.kubernetes.io/enforce: baseline
        pod-security.kubernetes.io/warn: restricted
    quota: 500
  nodeSelector:
    capsule.clastix.io/tenant: foo
  owners:
  - kind: Group
    name: bar
EOF

tenant admin is unable to label namespace:

kubectl label ns foo-one foo=bar
Error from server (Label pod-security.kubernetes.io/audit is forbidden for namespaces in the current Tenant. Forbidden are one of the following () or matching the regex pod-security.kubernetes.io.*): admission webhook "namespaces.capsule.clastix.io" denied the request: Label pod-security.kubernetes.io/audit is forbidden for namespaces in the current Tenant. Forbidden are one of the following () or matching the regex pod-security.kubernetes.io.*