Remove finalizers from secret when reference is removed

[timebertt]

What this PR does / why we need it:
This PR adds a new controller for secrets, that is only responsible for adding/removing grm's finalizer to/from secrets referenced by ManagedResources.
It watches ManagedResources and enqueues all secrets on a generation change, that are/were referenced by the ManagedResource. It additionally enqueues secrets with its finalizer on create and update to remove its finalizer if it missed an important update event during a downtime.

So now, grm properly removes its finalizer from secrets that are not referenced by a ManagedResource anymore.

Which issue(s) this PR fixes:
Fixes #52

Special notes for your reviewer:
Tests will fail because of changes introduced by #46, but should run green after rebasing on #53
✅ test-wise depends on #53

Release note:

`gardener-resource-manager` now properly removes its finalizer from secrets, that are not referenced by a `ManagedResource` anymore.

Please ensure, that `gardener-resource-manager` has the required permissions to also update secrets now.

[timebertt]

/kind bug
/needs review

[rfranzke]

Generally looks good! Just nits :)

[rfranzke]

Hm okay, I was more thinking about also including the

	if e.MetaNew == nil {
		log.Error(nil, "Update event has no new object meta", "event", e)
		return false
	}

part in this function. But anyways, it's fine and doesn't matter too much.

/lgtm

[timebertt]

Oh sorry, then I misunderstood.
Anyways, let's keep it this way, so we can have more meaningful logs in case of errors (like "Create/Update event" and also the event attribute) without passing basically everything to the helper function :)