Add a way (annotations?) to mark a Tekton Resource to be skipped=

Feature request

Provide a way to mark a Tekton resources (TaskRun or PipelineRun) to be skipped by the controller.
On of the possible idea would be to add an extra value to chains.tekton.dev/signed with a skip value, or an entirely new annotations (chains.tekton.dev/skip).

Use case

One of the use case for this is, if we enable chains on a very Tekton resources heavy cluster (like 5000s existing PipelineRun, or more…). At start, the chains controller will load them all and try to sign them all (more or less at once). This will possible generate a crazy amount of load if not completely kill the controller. One idea to reduce this, would be to allow a user to mark previous / existings resources to not be signed, making chains work essentially no-op when it starts (or very low).

It could also, probably, be useful if one is experimenting with some Pipeline or Task and doesn't want chains to sign it.

cc @lcarva @concaf

Start by tracing how the chains controller discovers and signs existing TaskRuns and PipelineRuns. Compare the proposed signed annotation value with a new skip annotation, then define the behavior for both resource types and verify it with controller tests; the issue names no files or tests.