Prevent users from adding a managed label/annotation that conflicts with an ancestor #144
Description
/good-first-issue
/cc @erikgb
Part of #47; see also #143.
Users should not be allowed to add new managed labels/annots which conflict with the same label/annot in an ancestor. Fortunately, we already store all that information in the forest (e.g. see here) so it should be fairly straightforward to prevent a conflict.
In theory, it might be nice to also prevent an admin from adding a label that would overwrite an existing managed label in a descendant; this is what we do for objects (admins must remove the conflicting object first). However, I don't think that's necessary here, because unlike in the case of objects, we won't actually overwrite the user's intent (it will still be in the HierarchyConfiguration's spec in the descendant, it just won't be applied). In addition, it's probably safer from a policy to not require admins to remove all conflicting managed labels in case there are policies attached to them (the same is true for objects, so we might want a better solution to this one day there as well).
So for now, let's only check for conflicts with ancestors, not descendants.