[Telemetry Operator] Exclusion of containers enables system namespace inclusion

[a-thaler]

Description
Assume a pipeline configuration like that:

apiVersion: telemetry.kyma-project.io/v1alpha1
kind: LogPipeline
metadata:
  name: cls-application-logs
spec:
  input:
    application:
      containers:
        exclude:
          - istio-proxy
...

then the expected behaviour according to documentation is that system namespaces are getting ignored (default behaviour for namespace selection stays untouched). In fact, that setting enables the streaming of logs for system namespaces.

[lindnerby]

Fluent bit's rewrite_tag filter only evaluated rules until one matches, thus chaining rules for namespace and container selectors didn't work. We fixed this by piggybacking container selector rules in the rewrite_tag filter, if present and
for any namespace selectors we create an additional grep filter.