Use ManagedResource in all provider worker controllers

[rfranzke]

After both gardener/gardener#1114 and #159 are merged we should adapt the worker controllers of all provider extensions to use ManagedResources instead of talking to the shoot API server directly for creation and reconciliation of the required RBAC roles of cert-broker.

In #164 all the control plane controllers are already adapted, thus, this PR can be taken as an example implementation.