sync: rework find-by-name behavior

[kenjenkins]

Summary

The ingress-controller sync functionality has logic to find an entity by name if the api.pomerium.io ID annotation is lost. It also has logic delete & recreate entities if the --sync-api-namespace-id argument changes.

However, these two behaviors do not currently work together correctly. If an entity is found by name in a different namespace than expected, the sync logic will try to update it rather than deleting and recreating it. This can cause ingress-controller to get stuck for that entity.

Instead of trying to do both things at once, separate these into two separate passes: the first pass will just restore the missing ID annotation. This annotation change will cause the object to be queued for reconciliation again. The second pass can then delete & recreate if needed.

Also log (at debug level) when deleting an entity due to a namespace change.

Related issues

TBD

Checklist

• reference any related issues
• updated docs
• updated unit tests
• updated UPGRADING.md
• add appropriate tag (improvement / bug / etc)
• ready for review