invoice-ninja: Fix network policy for ingress

Since the IP address assigned to the ingress controller is now managed
by keepalived and known to Kubernetes, the network policy needs to allow
access to it by pod namespace rather than IP address.  It seems that the
former takes precedence over the latter, so even though the IP address
was explicitly allowed, traffic was not permitted because it was
destined for a Kubernetes service that was not.

invoice-ninja/network-policy.yaml

@@ -29,8 +29,9 @@ spec:
     ports:
     - port: 25
   - to:
-    - ipBlock:
-        cidr: 172.30.0.147/32
+    - namespaceSelector:
+        matchLabels:
+          kubernetes.io/metadata.name: ingress-nginx
     ports:
     - port: 80
     - port: 443