Watch only labelled groups

[larsks]

Currently, the controller watches all Group resources, and then iterates through them to find groups that have the github.oddbit.com/sync label. It would be better if we could limit the controller to watch only those groups with the given label. It's not clear that this is possible with the operator sdk. There was support for this added to controller-runtime in kubernetes-sigs/controller-runtime#1435, but I'm not sure if this is exposed in the operator sdk.