WithStaticLabelSelectorAndInWriteCallsCheck returns a StorageWrapper that adds the given label selector to the reading calls (Get, List and Watch), but also checks that write calls (Create or Update) are refused with an error if the resource would not be matched by the given label selector.

UpsyncDiffAnnotationPrefix is an internal annotation used on downstream resources to specify a transformation that should be applied during the Upsyncing of the resource to upstream.

UpsyncerResourceTransformer defines a very simple transformer which transforms the resource by applying a the JSON patch found in the `internal.workload.kcp.io/upsyncdiff` annotation.