Fix version tracking on read timeout after an update
Fix version tracking on read timeout after an update

As we now timeout and restart reads (aka watches) after 10 seconds, what
was happening was:

- start a new read, from resource version X

- get an update from k8s (a genuine one, e.g. new namespace), with
  resource version Y > X

- continue the existing read...  (because that what 'stream=True' means)

- ...until it times out after another 10s: requests raises an exception
  that is caught in _manage_resource

- _manage_resource correctly skips calling _sync_resources, then calls
  _watch_resource again with resource version X

- k8s returns 410 error because X is too old; the call should have had
  version Y: exception is raised and caught in _manage_resource

- this exception causes us to resync, thus defeating our attempts to
  avoid an (unnecessary resync).

We can't pass the new resource version back up to _manage_resource when
the read timeout exception is raised, so rework version tracking to use
a dict in the Controller object.

projectcalico/k8s-policy,projectcalico/k8s-policy