Enforce bijection relationship between CR and actual S3 resource

With the current implementation, it seems possible to have multiple CRs (for instance `dummy-bucket1` and `dummy-bucket2`) reference a single S3 resource (based on the `spec.name`). This applies both to buckets and policies, and is probably unwanted.

This flew under the radar, for our CR creation process ensures we cannot reference the same S3 resource in two different CRs, but such might not be the case for other users.