Description of problem:

   Image policy is denying images due to a change is made to a rule that should not effect these images. 
  
Just changing this policy 
   
    openshift.io/ImagePolicy:
      configuration:
        apiVersion: v1
        executionRules:
        - matchImageAnnotations:
          - key: images.openshift.io/deny-execution
            value: 'true'
          name: execution-denied
          onResources:
          - resource: pods
          - resource: builds
          reject: true                       # Change to false 
          skipOnResolutionFailure: true
        kind: ImagePolicyConfig
 

Any pod created from containers that are not in our registry fail with the following event: 

The Pod "" is invalid: spec.containers[0].image: Forbidden: this image is prohibited by policy: only images imported into the registry are allowed (rhel7/rhel-tools)


Version-Release number of selected component (if applicable):
3.7

How reproducible:
100%

Steps to Reproduce:
1. Make change to the default imagepolicy in place, change reject to false. 
         - Reason for this change is due to openscap marking all image with the annotation "images.openshift.io/deny-execution" as a workaround we do not want to reject this. 

2. Restart masters 

3. Deploy new image to test

```
# oc create -f - <<EOF
apiVersion: v1
kind: Pod
metadata:
  name: sleep-test-pod
spec:
  containers:
  - name: sleep-test-container
    image: rhel7/rhel-tools 
    command: [ "/bin/bash", "-c", "--" ]
    args: [ "while true; do sleep 30; done;" ]
restartPolicy: Never
 EOF
 



Actual results:
   The Pod "" is invalid: spec.containers[0].image: Forbidden: this image is prohibited by policy: only images imported into the registry are allowed (rhel7/rhel-tools)

Expected results:
  Run this pod as the image policy should not have anything to do with this image. 



Workaround: 

  Either remove the policy all together or keep reject = true