Make ActorTemplate controller generate a golden tag

In #1417 we added support for garbage collecting snapshots from the object storage. Snapshots in the storage can be owned by either an `Actor` or a `Tag` resource.

When it's owned by an `Actor`, during `SuspendActor` we store the new snapshot, and delete the old one. Deleting an actor also deletes the actor owned snapshot.

When it's owned by a `Tag`, the snapshot referenced is immutable. Deleting the `Tag` resource deletes the snapshot from the storage.

There is a gap today in the way we manage "golden actors". The ActorTemplate controller creates a golden actor, waits for it to pass the readiness probe, suspends it, and stores the snapshot (owned by the actor) in the `ActorTemplate` status. This is problematic, as the snapshot is owned by the golden actor, and any subsequent resume/suspend cycle will delete it.

The proposed fix is to make the controller create the golden actor, resume, wait for readiness probe, suspend, and tag it, then delete the golden actor. The tagging process is what moves the ownership of the golden snapshot to a tag.

When an Actor is created, if an ObjectRef is provided in `Actor.source_tag`, the actor uses that snapshot as a starting point. If it's not provided, the ate-apiserver resolves the golden tag referenced in the ActorTemplate status, and uses it. The golden snapshot becomes nothing more than a "smart default" during `CreateActor`.