add new manifetwork update strategy to update only when resource changes in mw

[haoqing0110]

Describe the enhancement
A clear and concise description of what the enhancement request is.

This requirement comes from #630 (comment).
"when some thing changes on the spoke, do not update while when it changes in mw, update it."

For example, in mw defined a secret "bootstrap-hub-kubeconfig"

• when the secret is updated by other components, work-agent will not override it by mw.
• while if the secret is updated in mw, the work-agent will update it.

[haoqing0110]

/cc @qiujian16 @elgnay