Correlate dirty refresh issues

[t0yv0]

Work through the tracker to correlate issues with non-empty changes on pulumi refresh, to help understand causes and possible resolutions. Each issue should get a label area/refresh. Each issue should have a workaround.

#906 lambda without sourceCodeHash does not detect drift; reproduces in TF
#2246 managedPolicyArns dirty output when sidecar resources in use; self-corrects refresh
#2490 no repro but yields #3874 lambda refresh; self-corrects with up --refresh or refresh --yes
#2561 similar to 2246 but for RouteTable routes vs separate Route resources
#2720 eks.Cluster dirty refresh; self-corrects with up --refresh or refresh --yes
#2910 no repro as of writing this
#3868 aws.cloudwatch.onSchedule dirty refresh; self-corrects with up --refresh or refresh --yes
#3303 cognito.UserPool reorders set elements due to pulumi/pulumi-terraform-bridge#1904
#3361 aws.wafv2.WebAcl dirty refresh; self-corrects with up --refresh or refresh --yes
#3750 Fixed upstream
#3674 AWS-specific patching issue on legacy bucket
#3686 LaunchTemplate dirty refresh; self-corrects with up --refresh or refresh --yes

[t0yv0]

Import issues adjacent as they use Read call but not necessarily directly relevant, moved this to #3875

[t0yv0]

CC @flostadler

[pulumi-bot]

Cannot close issue:

• does not have required labels: resolution/

Please fix these problems and try again.