Selectively disable config controller kubernetes reconciliation of a specific resource - ie: switching billing account - without going through a kpt render/apply or config-sync flow

see #446
Use Case: change the billing account on a project without going through the yaml change
usually something like billing - if you change it - 5 min later it changes back. However you don't want to disable full reconcile
Need this because doing the following is not updating biling

```
root_@cloudshell:~/pdt-ls/obriensystems/pubsec-declarative-toolkit/solutions/project (kcc-boot-ls-8704)$ kpt fn render hub-env --truncate-output=false
root_@cloudshell:~/pdt-ls/obriensystems/pubsec-declarative-toolkit/solutions/project (kcc-boot-ls-8704)$ kpt live apply hub-env

spec:
name: xxdmu-admin4-ls # kpt-set: ${hub-project-id}
billingAccountRef:
external: "0164BE-9E728E-7D0FA6" # kpt-set: ${project-billing-id}
```

I am going to try to use the process for config controller sync
https://cloud.google.com/config-connector/docs/concepts/reconciliation#configuring_the_reconciliation_interval

```
```

later when using config sync check (thanks Chris C.)
https://cloud.google.com/config-connector/docs/concepts/reconciliation#configuring_the_reconciliation_interval