Ensure setting 'Missing' anchor state when ns cannot create

Fixes 1339

Currently in the anchor reconciler, when the new subnamespace has error
being created, anchor instance is not updated to set the 'Missing'
state.

This commit calls the `writeInstance()` (anchor instance) before
returning the creating namespace error to retry.

The other two alternatives to fix this problem considered are:
1) Update the `kubectl hns create` plugin to add 'Missing' as default
state in the created anchor object. The concern is that users may apply
manifests to create anchors instead of using `kubectl hns` plugin.
2) Update the anchor CRD not to omitempty the `status.state` field and
default to `Missing`. Since this is an API change and the fix in anchor
reconciler is simple, I didn't go with this approach.

Tested manually without any changes in the integration tests or e2e
test because, the only way to block a namespace creation consistantly is
through a validating webhook. Here's how I tested it manually:
I updated the namespace validator to not skip HNC SA on `CREATE`
operation and in `handle()` function deny any namespace with name `bbb`
to be created.

The subns `bbb` had empty status before the fix and had `state: Missing`
after the fix.

Author: yiqigao217

incubator/hnc/internal/reconcilers/anchor.go

@@ -99,6 +99,12 @@ func (r *AnchorReconciler) Reconcile(ctx context.Context, req ctrl.Request) (ctr
 	// If the subnamespace doesn't exist, create it.
 	if inst.Status.State == api.Missing {
 		if err := r.writeNamespace(ctx, log, nm, pnm); err != nil {
+			// Write the "Missing" state to the anchor status if the subnamespace
+			// cannot be created for some reason. Without it, the anchor status will
+			// remain empty by default.
+			if anchorErr := r.writeInstance(ctx, log, inst); anchorErr != nil {
+				log.Error(anchorErr, "while setting anchor state", "state", api.Missing, "reason", err)
+			}
 			return ctrl.Result{}, err
 		}
 	}