Resource deletion can occur with AllowPropagate

[afine]

We have noticed resources of kinds that are configured as AllowPropagate being deleted during our infrastructure provisioning process (even if the resources are not configured to propagate with HNC) if they share the name of a resource of the same kind in the parent namespace.

We were able to reproduce the issue reliably with a build of HNC from the master branch with this small patch that inserts a sleep to make sure the race condition can be reliably hit.

diff --git a/internal/objects/reconciler.go b/internal/objects/reconciler.go
index 81c0d785..9b44ac38 100644
--- a/internal/objects/reconciler.go
+++ b/internal/objects/reconciler.go
@@ -19,6 +19,7 @@ import (
 	"context"
 	"fmt"
 	"reflect"
+	"strings"
 	"sync"
 	"time"
 
@@ -585,8 +586,10 @@ func (r *Reconciler) operate(ctx context.Context, log logr.Logger, act syncActio
 }
 
 func (r *Reconciler) deleteObject(ctx context.Context, log logr.Logger, inst *unstructured.Unstructured) error {
-
 	stats.WriteObject(r.GVK)
+	log.V(1).Info("SLEEPING")
+	time.Sleep(100 * time.Second)
+	log.V(1).Info("DONE SLEEPING")
 	err := r.Delete(ctx, inst)
 	if errors.IsNotFound(err) {
 		log.V(1).Info("The obsolete copy doesn't exist, no more action needed")
diff --git a/internal/webhooks/webhooks.go b/internal/webhooks/webhooks.go
index 32d703d0..951aee27 100644

Steps to Reproduce:

1. Create an HNCConfiguration configuring configmaps to mode: AllowPropagate.
2. Create a parent namespace (parentns) and child namespace (childns).
3. Create a Configmap testmap in parentns (with no labels that would configure it to propagate with HNC)
4. Apply a HierarchyConfiguration to childns setting parentns as the parent of childns
5. At this point you should see the SLEEPING log line output from the patch above.
6. Now create a configmap testmap in childns (with no labels that would configure it to propagate with HNC)
7. At this point you should see we have two Configmaps

$ k -n parentns get configmap; k -n childns get configmap
NAME                 DATA   AGE
testmap              1      40s
NAME                 DATA   AGE
testmap             1      23s

8. Wait for the DONE SLEEPING log line.
9. You should now see one of the configmaps was deleted

$ k -n parentns get configmap; k -n childns get configmap
NAME                 DATA   AGE
testmap              1      40s
NAME                 DATA   AGE