OPA policy for Kubernetes memory limits