Add seed reconciler for secret replication

[timuthy]

How to categorize this PR?

/area security
/kind enhancement
/priority normal

What this PR does / why we need it:
This PR adds a new seed reconciler which:

• creates a dedicated namespace per seed seed-<seed-name>
• replicates secrets with gardener.cloud/role label from the garden namespace to seed-<seed-name> namespaces

In the future, this dedicated namespace will allow us to restrict Gardenlets to only access these namespaces (see #1723).

Which issue(s) this PR fixes:
Fixes parts of #1723

Special notes for your reviewer:
The seed lifecycle controller was refactored along the way and now implements the reconcile.Reconciler interface.

/cc @rfranzke

Release note:

A new `Seed` reconciler was added to the Gardener-Controller-Manager. It creates a dedicated namespace per seed in the Garden cluster `seed-<seed-name>` and copies common secrets from the `garden` Namespace (labelled with `gardener.cloud/role`) to the seed namespace. Gardenlets are supposed to read secrets (or namespaced objects in general)  from seed dedicated namespaces only in the future.

[timebertt]

One question from my side.
Looks good overall :)

[timebertt]

Thanks for addressing my suggestion.
Very nice!
/lgtm