[new feature] Propagate sandbox spec labels to signadot managed custom resources

[jsalem-brex]

New feature or functionality
You can add labels to the sandbox spec, but they appear to only exist in the context of the Signadot API. It would be super useful if these labels were propagated to at least the root sds resource that gets created from the spec. It could also be useful to propagate these to other resources associated with an sds. This would allow querying for sandbox related resources using kubectl with label selectors.