fix: skip source namespace in replicate-to-matching

[mcastellini]

Problem

When a replicate-to-matching label selector also matches the source object's own namespace, the replicator copies the resource onto itself. That write updates the source object, which re-triggers the informer and produces an unbounded reconciliation loop — continuous writes that hammer the kube-apiserver. (In our case the looping objects were TLS secrets watched by an ingress controller, which rebuilt and revalidated its entire data plane on every write and pinned its CPU.)

The replicate-to (namespace pattern) strategy already guards against this in getNamespacesToReplicate:

if namespace.Name == myNs {
    // Don't replicate upon itself
    continue
}

…but the replicate-to-matching (label selector) strategy lists namespaces straight from the API and passes them through unfiltered, so the source's own namespace can end up as a target.

Fix

Apply the same self-skip in replicateResourceToMatchingNamespacesByLabel: filter the source namespace out of the selector-matched list before replicating.

Tests

Adds two regression tests in replicate/secret:

• replicate-to-matching self-match — fails without this change, passes with it.
• replicate-to pattern self-match — exercises the pre-existing guard, which had no coverage.

Both verified against a kind cluster; the full replicate/secret suite passes.

Fixes #407

[mcastellini]

@elenz97, any chance you can look at this fix?

[elenz97]

Looking good, thank you for looking into this @mcastellini!