Images are synced to controllers that are part of deployments that the image is not enabled on

[scottmbaker]

I think it would be best to only sync images to those controllers that relate to a deployment where the image has been enabled. Two reasons:

1. It would prevent syncing images to controllers where the image will never be used (i.e. there's no need to sync an image to Enterprise controllers if the image is only to be used on the Vicci deployment)

2. It would prevent the observer from syncing an image from /opt/xos/images before the administrator is ready. Right now the observer can and will sync an image while it is being uploaded.

Idea: tackle this the model_policy level instead of the observer level, prevent ControllerImage objects from being created unless "Controller.deployment in Image.deployments".