Add explicit mention of whether Sigstore Policy Controller is appropriate to use in production environments

[dp-rp]

Description

Hello! We're investigating methods of enforcement of container image signature validation for a project at my workplace, and I thought it might be valuable to note there's no explicit mention of "Policy controller [is]/[is not] appropriate for usage in production environments" in the documentation. This may be a good thing to add to quickly communicate the maturity and stability of the solution for those comparing alternatives.

Certainly not a necessity, but a nice to have that's good for communicating project intent!

Thanks for your consideration! 🙂