Exemptions with same matcher twice cause erroneous deletes

[mjnagel]

Here's a minimal reproduction of the issue I'm seeing:

apiVersion: uds.dev/v1alpha1
kind: Exemption
metadata:
  name: test
  namespace: uds-policy-exemptions
spec:
  exemptions:
    - policies:
        - DisallowHostNamespaces
      matcher:
        namespace: test
        name: "^test-pod.*"
    - policies:
        - DisallowPrivileged
      matcher:
        namespace: test
        name: "^test-pod.*"
    - policies:
        - RequireNonRootUser
      matcher:
        namespace: test
        name: "^test-pod.*"
    - policies:
        - DropAllCapabilities
      matcher:
        namespace: test
        name: "^test-pod.*"

If you apply this manifest the peprstore ends up only having the DropAllCapabilities exemption. This would be true anytime someone uses the same exact matcher in the same CR (i.e. anytime name, namespace, kind, and owner line up), but with multiple separate policy lists. I do think is a quite viable situation that we should support if we can - someone might want to separate out exemptions within the same CR so that they could put specific descriptions on each for example. Happy to help brainstorm how to handle this.

Originally posted by @mjnagel in #290 (comment)