fix(vm): watch provisioning secrets in cse

[eofff]

Description

React to creating and modifying provisioning secrets.

Why do we need it, and what problem does it solve?

If a VM refers to a provisioning secret and is created before it exists, it may remain pending because there is no reason to reconcile.

What is the expected result?

A VM starts.

Checklist

• The code is covered by unit tests.
• e2e tests passed.
• Documentation updated according to the changes.
• Changes were tested in the Kubernetes cluster manually.

Changelog entries

section: vm
type: fix
summary: React to creating and modifying provisioning secrets.
impact_level: low