Removed redundant managed secrets when ProviderConfig secret references change

[christophrj]

What happened?

Redundant secrets don't get deleted when an operator updates the secret references in the ProviderConfig.

What you expected to happen?

Redundant image pull secret copies are removed by the service provider.

How to reproduce it (as minimally and precisely as possible)?

1. Add a imagePullSecret reference to secret-a in the ProviderConfig.
2. Wait until the update is successfully reconciled and a copy exists in the velero namespace on the MCP cluster.
3. Change the imagePullSecret reference in the ProviderConfig to reference a new pull chart secret secret-b
4. Wait until the update is successfully reconciled and a copy exists in the velero namespace on the MCP cluster.

-> secret-copy-a still exists and should have been removed as part of the update.

Anything else we need to know?

• see e.g. OrphanCleaner implementation in sp-flux https://github.com/openmcp-project/service-provider-flux/blob/main/pkg/flux/manager.go#L49