Provide some kind of "semantic diff" between old and new objects for updates #46
Description
Sometimes, in conditionally authorized updates, one wants to make sure that some fields (recursively) were or were not changed. For example, one could want to require that "principal P can update/patch resource R, but only if metadata is unchanged" (or ownerReferences stay static, or finalizers (#13), or some spec/status field).
One special case for this is the scheduler having its own pods/binding subresource, which practically only allows changing one field, spec.nodeName, keeping the pod otherwise unchanged.
There are use-cases for the generalized version of this as well; and that would be interesting to explore. Now that SSA is a thing as well, maybe one could express something like "principal P is only allowed to have 'this wide' managed fields set"?