controller does not reconcile `Passwords` and `Secrets`

**What steps did you take:**

I created a `Password` with some labels. Then I wanted to add another label and was hoping that this change gets pushed down to the `Secret`. Because this did not happen, I deleted the `Secret` in the hopes that the `secretgen-controller` would reconcile and recreate the `Secret`, now with the updated set of labels from the `Password`:

Steps taken:

- install the secret-gen controller:
```shell
k apply -f https://github.com/vmware-tanzu/carvel-secretgen-controller/releases/download/v0.9.1/release.yml
```
- create a password
```shell
cat <<'EOF' | k apply -f -
kind: Password
apiVersion: secretgen.k14s.io/v1alpha1
metadata:
name: the-passoword
labels:
initalLabel: something
spec:
length: 10
secretTemplate:
type: Secret
stringData:
password: $(value)
EOF
```
- inspect the labels on the `Password` and the `Secret`:
```shell
k get password,secret -o yaml | yq -r '.items[] | "\(.kind): \(.metadata.name) => \(.metadata.labels)"'

Password: the-passoword => {"initalLabel":"something"}
Secret: the-passoword => {"initalLabel":"something"}
```
- change labels on the `Password`:
```shell
k label password/the-passoword anotherLabel=somethingElse

password.secretgen.k14s.io/the-passoword labeled
```
- inspect the labels again:
```shell
k get password,secret -o yaml | yq -r '.items[] | "\(.kind): \(.metadata.name) => \(.metadata.labels)"'

Password: the-passoword => {"anotherLabel":"somethingElse","initalLabel":"something"}
Secret: the-passoword => {"initalLabel":"something"}
```
- delete the secret:
```shell
k delete secret the-passoword
```
- see, that the secret is gone:
```shell
k get password,secret -o yaml | yq -r '.items[] | "\(.kind): \(.metadata.name) => \(.metadata.labels)"'

Password: the-passoword => {"anotherLabel":"somethingElse","initalLabel":"something"}
# Note, we don't see no `Secret` anymore.
```
- see, that there are no reconcile errors or something:
```shell
k get password/the-passoword -o yaml | yq -y .status

conditions:
- status: 'True'
type: ReconcileSucceeded
friendlyDescription: Reconcile succeeded
observedGeneration: 1
```

**What happened:**

"Nothing". First the `Password` did not update the labels on the `Secret` it created. And then, after the `Secret` was deleted, the controller made not attempts to recreate the `Secret` again.

**What did you expect:**

I expected
- the controller to update the `Secret`'s metadata when I update the `Password`'s metadata
- the controller to recreate the `Secret` or give me an error and tell me it cannot recreate the secret (Because it does not know the original password, which *cloud* be a valid failure case IMHO)

**Anything else you would like to add:**

I could see that there are reasons to not reconcile the `Secret`, because the controller has no knowledge of the original password, and for some cases it might be better to not reconcile than to reconcile with a changed password. However, if that's the case I think we should at least call that out in the docs or, ideally, have the controller tell users about that in its status subresource.
I think it is "surprising" that the controller seems to be doing nothing at all once the secret is created.

This bug report outlines two different issues. Technically, I guess, they need to address different things (watching updates/deletion of secrets vs. watching updated of passwords). I am happy to split the issue. However, from a user's point of view, I think they are "the same" in the sense that the controller does not seem to reconcile at all.

There was a short discussion about this in [#carvel](https://kubernetes.slack.com/archives/CH8KCCKA5/p1657900918552639).

**Environment:**

- secretgen-controller version
```yaml
k get deployment -n secretgen-controller secretgen-controller -o yaml | yq -r '.metadata.annotations["kbld.k14s.io/images"]'

- origins:
- local:
path: /Users/dk/workspace/carvel-secretgen-controller
- git:
dirty: false
remoteURL: git@github.com:vmware-tanzu/carvel-secretgen-controller
sha: 3b76cf0602b6c377fca8589c5fa30b9f04fc51a0
tags:
- v0.9.1
url: ghcr.io/vmware-tanzu/carvel-secretgen-controller@sha256:1f842b9c3e0ee164b450c10486d7b08eee0eacb754af42549aa64906221f7966

```
- Kubernetes version (use `kubectl version`)
```shell
k version
WARNING: version difference between client (1.21) and server (1.24) exceeds the supported minor version skew of +/-1
Client Version: version.Info{Major:"1", Minor:"21", GitVersion:"v1.21.1", GitCommit:"5e58841cce77d4bc13713ad2b91fa0d961e69192", GitTreeState:"clean", BuildDate:"2021-05-12T14:18:45Z", GoVersion:"go1.16.4", Compiler:"gc", Platform:"linux/amd64"}
Server Version: version.Info{Major:"1", Minor:"24", GitVersion:"v1.24.0", GitCommit:"4ce5a8954017644c5420bae81d72b09b735c21f0", GitTreeState:"clean", BuildDate:"2022-05-19T15:39:43Z", GoVersion:"go1.18.1", Compiler:"gc", Platform:"linux/amd64"}
```
---
Vote on this request

This is an invitation to the community to vote on issues, to help us prioritize our backlog. Use the "smiley face" up to the right of this comment to vote.

👍 "I would like to see this addressed as soon as possible"
👎 "There are other more important things to focus on right now"

We are also happy to receive and review Pull Requests if you want to help working on this issue.