track ResourceGroup changes and opt-in updates

[a-hilaly]

Feature Description

Currently instances don't track which version of their parent ResourceGroup they were created from. we need to add support for tracking ResourceGroup generation and resourceRevision (not sure about the revision) in instance status, and require an annotation (kro.run/allow-updates: "true") for instances to receive updates from their parent ResourceGroup. This prevents unexpected changes to running instances when ResourceGroups are modified.

Example:

apiVersion: kro.run/v1alpha1
kind: Application
metadata:
  name: my-application
  annotations:
    kro.run/allow-updates: "true"  # Required to receive parent RG changes
spec:
  name: my-app
  image: nginx
status:
  resourceGroupGeneration: 123  # Track parent RG's metadata.generation
  resourceRevision: abc123           # Track parent RG's spec hash/revision