block template deployment if GK version is not compatible

[sozercan]

If there's a CT that includes new rego keywords (such as future) we should have a minVersion annotation that we can use for blocking the deployment of new templates.