Only compare canonical portions of objects
Only compare canonical portions of objects

I noticed that on GKE, system-created ResourceQuota objects were being
marked as having been "modified" when they were not. The problem was
that we were comparing the `.status` fields, which can legitimately be
different between different namespaces - for example, on GKE, the
`default` namespace contains one service while other namespaces do not,
resulting in `resourcequota.status` differing between namespaces.

In addition, we weren't correctly ignoring all the HNC labels and
annotations. I think this means that if we *transiently* set some
annotation (including the `modified` annotation itself), this would then
be treated as a modification and it will never be removed.

To fix this, I've clarified that the semantics of the HNC are to _only_
propagate the name, spec, and non-HNC labels and annotations; this is
referred to as the "canonical" object (this replaces the "blacklisted"
metadata field behaviour we previously had). I've renamed `copyObject()`
to `canonical()` which now returns the canonical object. The returned
object can be directly compared to objects from other namespaces,
simplifying the code.

Tested: on GKE, automatically populated and identical objects like
gke-resource-quotas are no longer marked as being modified. Verified
that non-HNC labels are propagated correctly.

kubernetes-sigs/multi-tenancy,kubernetes-sigs/multi-tenancy