Make the canExcludeNewProcesses more flexible

[johscheuer]

What would you like to be added/changed?

Currently the canExcludeNewProcesses check in our exclude sub reconciler has a black/white decision either we can exclude all provided processes or none. This has some potential to get the operator stuck at different places e.g. when a resource quota is hit. We should change that method to make it more flexible and consider those thresholds per process class. In addition to that I think it make sense to add some mechanism that allows a number of processes to be excluded (something like maxSurge or a bucket) e.g. to allow the operator to make progress even if we exclude/remove processes one by one in the worst case.

I would like to see a technical design before we implement this feature. I'll try to find some time in the near future to write down my thoughts in a proposal.