A Tanzu Mission Control administrator would like to enforce the following container controls:
Only allows container images that match the specified names or tags.
Ensure that the container image is not tampered with.
Which type of policy can be used?