GitOps docs: Configuration profiles - target hosts by excluding any label (#20779)

Changes related to: #17315

docs/Using Fleet/GitOps.md

@@ -231,12 +231,16 @@ controls:
     deadline_days: 5
     grace_period_days: 2
   macos_settings:
-    - path: ../lib/macos-profile1.mobileconfig
-      labels:
-        - Label name 1
-    - path: ../lib/macos-profile2.json
+    custom_settings:
+      - path: ../lib/macos-profile1.mobileconfig
+        labels_exclude_any:
+          - Label 1
+      - path: ../lib/macos-profile2.json
+        labels_include_all:
+          - Label 2
   windows_settings:
-    - path: ../lib/windows-profile.xml
+    custom_settings
+      - path: ../lib/windows-profile.xml
   macos_setup: # Available in Fleet Premium
     bootstrap_package: https://example.org/bootstrap_package.pkg
     enable_end_user_authentication: true
@@ -265,7 +269,7 @@ controls:
 
 Fleet supports adding [GitHub environment variables](https://docs.github.com/en/actions/learn-github-actions/variables#defining-environment-variables-for-a-single-workflow) in your configuration profiles. Use `$ENV_VARIABLE` format.
 
-Use `labels` to only apply (scope) profiles to hosts that have all those labels.
+Use `labels_include_all` to only apply (scope) profiles to hosts that have all those labels or `labels_exclude_any` to apply profiles to hosts that don't have any of those labels.
 
 #### macos_setup