kyverno: [BUG] Validate that negation anchor is empty or null

Software version numbers State the version numbers of applications involved in the bug.

• Kubernetes version: 1.19.3
• Kyverno version: 1.3.5

Describe the bug Kyverno needs to validate an incoming rule and if the negation anchor (X(foo)) is specified for a field, that value needs to be null, nil, or undefined. It should not have a value in it.

To Reproduce Steps to reproduce the behavior:

1. Create this policy. See that - X(key): "node-role.kubernetes.io/master" is used here.

apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: restrict-controlplane-scheduling
  annotations:
    policies.kyverno.io/title: Restrict control plane scheduling
    policies.kyverno.io/category: Sample
    policies.kyverno.io/description: >-
      This policy prevents users from setting a toleration
      in a Pod spec which allows running on control plane nodes
      with the taint key "node-role.kubernetes.io/master".         
spec:
  validationFailureAction: enforce
  background: false
  rules:
  - name: restrict-controlplane-scheduling
    match:
      resources:
        kinds:
        - Pod
    validate:
      message: Pods may not use tolerations which schedule on control plane nodes.
      pattern:
        spec:
          =(tolerations):
            - X(key): "node-role.kubernetes.io/master"

1. Notice Kyverno allows this to be created even though the negation anchor does not work by supplying a value (it checks that the key is not defined, not that its value is not present).

Expected behavior Kyverno should reject this policy because the value of the negated field is non-null.

Additional context This is how the same policy should be written instead:

apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: restrict-controlplane-scheduling
  annotations:
    policies.kyverno.io/title: Restrict control plane scheduling
    policies.kyverno.io/category: Sample
    policies.kyverno.io/description: >-
      This policy prevents users from setting a toleration
      in a Pod spec which allows running on control plane nodes
      with the taint key "node-role.kubernetes.io/master".   
spec:
  validationFailureAction: enforce
  background: false
  rules:
  - name: restrict-controlplane-scheduling-master
    match:
      resources:
        kinds:
        - Pod
    validate:
      message: Pods may not use tolerations which schedule on control plane nodes.
      pattern:
        spec:
          =(tolerations):
            - key: "!node-role.kubernetes.io/master"