Avoid propagating ApplySet labels to owned resources

[BjarkeTornager]

Summary

• exclude labels in the applyset.kubernetes.io/ namespace when propagating RestateDeployment labels
• apply the filter to versioned Services and Knative Configurations/Routes
• retain all ordinary user labels
• document the behavior change

Why

kubectl adds applyset.kubernetes.io/part-of to resources applied with --applyset. Copying it to an operator-owned versioned Service makes that Service look like a direct ApplySet member. When the same ApplySet contains the Service kind, a later prune can delete the versioned Service before Restate has drained that deployment.

Because the children are server-side applied by the operator, a reconciliation after upgrade also removes labels that older operator versions propagated.

Validation

• cargo fmt --check
• cargo test --lib (83 passed)
• cargo clippy --all-targets --all-features -- -D warnings

cargo test also runs five existing doctests that fail on current main; all 83 unit tests pass.

Closes #170.

[github-actions]

All contributors have signed the CLA ✍️ ✅
_{Posted by the CLA Assistant Lite bot.}

[BjarkeTornager]

I have read the CLA Document and I hereby sign the CLA

[BjarkeTornager]

@pcholakov I signed the CLA now. Anything else needed from my side to get this merged in?

[lukebond]

apologies for being slow to get back to you! i've fallen a bit behind on my maintenance here but catching up, and will get this reviewed shortly. nothing more you need to do.