Reconcile all relevant hcloudmachines when hcloud token got replaced

[janiskemper]

/kind feature

Describe the solution you'd like
When the hcloud token is invalid / got invalidad, then we cannot act with the HCloud API (anymore).

Once the token is updated to the correct one, it would be possible though.

We should ensure that the HCloudMachines react on a change in the secret immediately. This is especially important, since the objects don't reconcile at all anymore, once we detected an unauthorized error - because there is usually no immediate change (MachineHealthChecks regularly delete the machines though).

We should test this in a real-world setup and ensure that this works properly:

1. Have a healthy cluster running.
2. Invalidate the hcloud token by removing it from the Hetzner UI.
3. Scale the cluster to request more virtual servers.
4. Add a new token via Hetzner UI and replace it in the secret.
5. Ensure that HCloudMachines immediately reconcile and pick up the new token.

[abdullah599]

we can add a watch on corev1.Secret in the HCloudMachine controller. When a secret in the namespace changes, a small mapper function figures out which HCloudMachines use that secret and enqueues them for reconcile.

The mapper lists HetznerClusters in the same namespace, checks which ones have Spec.HetznerSecret.Name equal to the changed secret, and then reuses our existing HetznerClusterToHCloudMachines helper to get the list of HCloudMachines.

I can also add a small predicate so we only react when the secret Data actually changes. This avoids noise from routine metadata updates.

@janiskemper WDYT?

[janiskemper]

sounds good