Selectively remove OPA cached data upon config set changes

[shomron]

The config controller currently does a full wipe and rebuild of the OPA data cache whenever the set of resources to watch changes.

It would be less disruptive if we calculated the change set and selectively removed only the resources that are no longer desired upon a configuration change. This will require API changes in framework to either allow listing keys are allow some kind of pattern-based selection for delete.