Policy bypass via deletionTimestamp exemption

Improper authorization in Kyverno before 1.10.0 allows remote authenticated users to bypass enforced policies on non-Pod resources. Kyverno's policy engine skips validate, generate, and mutate-existing processing when a resource has deletionTimestamp set, treating it as pending deletion. An attacker needs Kubernetes permission to add an indefinite finalizer and initiate deletion; the retained resource can then evade policy controls without affecting Pods.