Sync object propagation on newly labeled namespaces

[yiqigao217]

Fix #1448

Detect namespace label changes. If the labels are updated, ensure
syncing all the objects (including non-existing yet but possible
propagated objects) in the namespace, so that we will not miss any
propagation label changes that should trigger propagation or
unpropagation.

Add integration tests in reconciler/object_test.go.

Tested manually that labeling and unlabeling a child with the propagate
label won't do anything before the fix, but triggers propagation and
unpropagation accordingly after the fix. Also tested with make test,
passed after the fix ant failed before the fix.

[k8s-ci-robot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: yiqigao217

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [yiqigao217]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[yiqigao217]

/hold
until the issue in the integration test is figured out.

@adrianludwin the newly-added integration test always passed, no matter before or after the fix. I guess the source object is somehow reconciled very frequently in the integration test environment, so it can sync propagated objects in children frequent enough that we cannot reproduce the result in #1448 before the fix. I'm not sure what else I can try to fix this integration test issue.

You can search for ??????? in the code to see two of my comments in the code.

Just to be clear, this PR fixed #1448 and worked as expected, but we need to fix the integration test to make it fail before the fix.

[adrianludwin]

I don't have any great ideas about why this isn't working - I'd just add a ton of log messages so you can see exactly what gets called and when and try to debug it that way (make sure you only submit the most essential messages though). E.g. with a reasonable sleep of 10s (which should show up nicely in the logs) you should be pretty sure that HNC is quiet, and so you'll be able to see why it's not behaving as you expect.

[adrianludwin]

Maybe there's something special about adding a label via kubectl as opposed to updating the entire namespace via the client? I hope not, but it's possible.

[yiqigao217]

/hold cancel

/assign @adrianludwin
/assign @rjbez17

[adrianludwin]

/lgtm
/hold
/assign @rjbez17

[rjbez17]

/hold cancel
/lgtm