feat(operator): add finalizer to package CRs to await removals properly

[mjnagel]

Description

Adds a k8s finalizer to all Package CR resources during initial reconciliation. This will ensure that all packages end up with the finalizer, even on an upgrade.

Switching to a finalizer removes the usage/need for Pepr's .IsDeleted since we are actually watching for updates now (when a resource is deleted it will have an update with a deletionTimestamp). The deletion logic was moved to the packageReconciler to trigger when a deletionTimestamp is present. The first step in the deletion logic is patching the Package to a new status of "Deleting".

A few notes on the new behavior:

• Packages with SSO clients will take a few seconds to full delete their client and remove the token from the store. During this time they will be in the Deleting phase.
• Packages without SSO clients will delete nearly instantly in most cases.
• Since this is now in the same queue as other events, deletions may be slightly delayed depending on other events in the queue. This is mostly a good thing since it ensures that deletions are processed before new creations/changes - but it does result in slightly odd behavior for the end user since status does not change while a package is waiting in the queue.

Related Issue

Fixes #523

Type of change

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Other (security config, docs update, etc)

Checklist before merging

• Test, docs, adr added or updated as needed
• Contributor Guide followed

[mjnagel]

Closing for now, pending upstream Pepr changes to natively support this (see issue).