Describe the bug

CF Manifests support annotations and labels. These should be translated to labels and annotations on the pods to allow greater customization.

For instance in our usecase we want to apply a certain policy using a podSelector. If we could deploy our apps with a label using the manifest, we could match on that label.

To Reproduce*

Steps to reproduce the behavior:

1. Create a test app with this manifest:

---
applications:
  - name: go-webserver
    health-check-type: process
    instances: 1
    metadata:
      annotations:
        another: "hey"
      labels:
        test: "hello"

2. cf push
3. Notice that neither the annotation nor labels gets applied on the pod

I do understand the use-case, but I also share the security concerns. I would recommend that this feature is guarded by explicit configuration, e.g. allow_application_annotations and allow_application_labels. The most convenient config API might be to allow a list of allowed keys (or key prefixes) and support * as an all-in option.