k8s/reconciler: update/replace resources

[lorenz]

Sometimes (for example in https://review.monogon.dev/c/monogon/+/2784) we need to update (or in cases of immutable fields) replace Monogon-managed resources to apply fixes. This issue is for non-version-critical fixes, separate from #272. The changes talked about in this issue can be applied at any time and are intended to just be applied as soon as the control plane node running the reconciler is upgraded.