make resource annotations more resilient to being clobbered by external actors

per investigation with @jorgemoralespou, [tekton](https://tekton.dev/) copies over all annotations from Pipeline to PipelineRun resource. in our case both Pipeline and PipelineRun resources are being directly created by the user via kapp (kapp annotates both with various resource specific metadata eg kapp.k14s.io/identity). when tekton controller replaces metadata annotations kapp no longer believes that this resource is being directly managed by the user (it still tracks it but as a cluster created resource).

one solution that may solve this problem is to use "unique" annotations (eg `kapp.k14s.io/identity.`) so that if some controller does copy over annotations from other resources, one can potentially still detect "true identity" of the resource. this of course does not cover the case when controllers are deleting annotations (instead of merging).

another possibility potentially is to keep metadata outside of the resource but that comes at a price of doing your own garbage collections, figuring sizing constraints etc.

Start by reproducing how Tekton copies Pipeline annotations to PipelineRun resources and how kapp uses kapp.k14s.io/identity to track direct management. Compare the proposed unique-annotation approach with storing metadata outside resources, and define behavior for copied or deleted annotations before identifying the relevant kapp entry points and tests.

Written by the indexing model from the issue text.