By default gatekeeper resets the cache of synced data whenever the list of watched resources changes.

This is not the case when the list of constraint kinds to watch changes.

This means that any cached resource deleted while the watch manager is restarting has the possibility of being stuck in the cache.

Generally speaking, we should be running a reconcile loop over cached data and removing any stale data.

This will both avoid the need to wipe the OPA cache each time the set of synced resources changes and the need to add any synchronization logic between the constrainttemplate controller and the config controller.

While we're at it, we should add the same kind of logic for constraints and constrainttemplates. This would allow us to remove finalizers altogether.