Extend controllerhelpers.Prune with a safety check on objects without a controllerRef

[mflendrich]

Issue originally authored by tnozicka as #2010

Controllers should only act on objects that are owned by them through an ownerRef, or by having a label selector in cases where there is no viable owner. Maybe we can add a top level object in the future so all can have a parent, even the ones that are shared.

Generally, the ownership check is done when claiming the objects before the sync loops are ran. As an additional safety check, @zimnx proposed to have an explicit flag allowMissingControllerRef for controllerhelpers.Prune that would make sure objects without controllerRef would need it to be explicitly set. Although this wouldn't check the actual owner again.