Enforce bijection relationship between CR and actual S3 resource

[phlg]

With the current implementation, it seems possible to have multiple CRs (for instance dummy-bucket1 and dummy-bucket2) reference a single S3 resource (based on the spec.name). This applies both to buckets and policies, and is probably unwanted.

This flew under the radar, for our CR creation process ensures we cannot reference the same S3 resource in two different CRs, but such might not be the case for other users.