bug: PublishedResource updates leave previous sync controllers active

[adoi]

Describe the bug

When updating a PublishedResource the manager starts a replacement without stopping the controller for the previous resource version. Both controllers then reconcile the same resources

Steps To Reproduce

1. Run api syncagent with an active PR
2. Update the PR (in my case spec.naming was changed, but it can be an annotation change)
3. Check a new controller will start for the new resource, but the previous controller doesn't stop
4. You can also create a synchronized resource again and you will see that both (or multiple) controllers will process it

Expected Behaviour

One sync controller should be active per PR. A replacement should be validated, then the existing controller drained before the replacement starts

Additional Context

I reproduced this with v0.7.0.

During my testing and implementation I checked that immediate replacement can overlap controllers. Stopping before validation can interrupt synchronization, so my approach for the solution is object key tracking with validate, drain, then start sequencing

[adoi]

/assign