Update secrets on resource version change only

[ciarams87]

Proposed changes

Problem: Controller-runtime forces a reconciliation after a certain amount of time, even if the resources have not changed (default is 10 hours. For many resources, we have a generation changed predicate, meaning we do not process any changes unless there is a change in the spec. Secrets, however, do not have a generation ID and so cannot have such a predicate.

Solution: Secrets do have a resource version, and the controller-runtime provides a ResourceVersionChangedPredicate we can use similarly to the GenerationChangedPredicate we use elsewhere.

Testing: Left running overnight and confirmed the behaviour (reconciliation of the secrets) no longer occurred.

Please focus on (optional): Please note that this approach does not introspect the cert and key for changes, and a reconciliation will still occur where the cert and key remains the same but a different property (e.g. an annotation) changes meaning the resource version will have changed.

Closes #1112

Checklist

Before creating a PR, run through this checklist and mark each as complete.

• I have read the CONTRIBUTING doc
• I have added tests that prove my fix is effective or that my feature works
• I have checked that all unit tests pass after adding my changes
• I have updated necessary documentation
• I have rebased my branch onto main
• I will ensure my PR is targeting the main branch and pulling from my branch from my own fork

Release notes

If this PR introduces a change that affects users and needs to be mentioned in the release notes,
please add a brief note that summarizes the change.

NONE

[kate-osborn]

LGTM

Do you think we should file another issue to optimize secret processing further and only reload NGINX when the secret's content changes?

[salonichf5]

lgtm

[ciarams87]

Do you think we should file another issue to optimize secret processing further and only reload NGINX when the secret's content changes?

@kate-osborn I added an additional task to #1664 - I would be hopeful that we could find a solution that handles all cases where we reload NGINX unnecessarily