fix: prePuller.hook.pullOnlyOnChanges didn't work, now it does

[consideRatio]

Closes #2172 by the strategy described in #2172 (comment).

In brief:

1. the checksum of the hook-image-puller daemonset that was calculated became different based on from what template origin calculated the checksum as .Templates.Name changed which in turn influenced rendered labels.
2. the checksum of the hook-image-puller daemonset that was calculated became different based on .Chart.Version as found in labels as well, which was irrelevant to re-pull on.
3. the rbac resources used by hook-image-awaiter were created no matter what, but now they are created based on if the hook-image-awaiter job is created.

Note though that we do want to pull again if something has changed about node affinity etc, so instead of just creating a list of the images it makes sense to still use a checksum of the k8s resource with some parts omitted, like the labels in the metadata section.