A namespace currently warns about violations of the restricted Pod Security Standard but still accepts noncompliant Pods. Which namespace label enables rejection of new violating Pods?

1. pod-security.kubernetes.io/warn: restricted only
2. pod-security.kubernetes.io/enforce: restricted
3. An annotation named restricted: true
4. pod-security.kubernetes.io/audit: restricted only