Emit fewer OperatorPolicy events

Previously, every time the controller determined a piece of the status
for an OperatorPolicy, it updated the policy status on the cluster, and
emitted a compliance event. This made each condition's logic more self-
contained, but leads to more API calls than necessary.

Now, each `handle*` function returns whether the status in the cluster
needs to be updated, and the controller will make a maximum of one
status update pre reconcile. That status update will update all of the
conditions and related objects at once. It will also send one compliance
event at that point, reflecting the "final" state of the policy.

Some `handle*` functions *should* emit multiple events: for example an
enforced policy should report when something is missing, and then
separately report if that resource was successfully created. So, some
of the functions return "early" conditions, which the controller emits
before the end of the reconcile. Compare this to "event batches" in
ConfigurationPolicy.

Signed-off-by: Justin Kulikauskas <jkulikau@redhat.com>