Deployment-wide rules

Issue: Using update rings and excluding groups, when a new update or app deployment is created, the exclusion is moved to the new deployment but the previous deployment loses the exclusion and installs on previously excluded entities.

Proposed solution: Add an additional section for deployment-wide rules that apply to the deployment regardless of rings. These rules would stay applied throughout the entire life cycle of that deployment.