Restrict ingress hosts to a single namespace

If someone creates an Ingress for a given hostname, it shouldn't be possible to create an Ingress for the same hostname in a different namespace.

This can probably be enforced with Kyverno, otherwise we'd need another admission controller.

Starting points:

• Unique Ingress Host: disallow two Ingresses with the same hostname, even in the same namespace
• Unique Ingress Path: disallow two Ingresses with the same root path