The annotation is immediately removed by `gardener-apiserver` via
https://github.com/gardener/gardener/blob/df16d9b9a5b4603fe5f6f495bad260fc4f892688/pkg/apiserver/registry/core/backupbucket/strategy.go#L67-L70,
so it doesn't make sense to check whether it is present or not. Let's
remove this.

- the first parameter should be the control plane namespace
- for regular shoots, the technical ID and the control plane namespace
  are equal, i.e., it doesn't make a difference
- for autonomous shoots, they are not equal, and we actually want to use
  the control plane namespace here.

- earlier, the secret was just always put into the `garden` namespace
  (undocumented contract)
- for autonomous shoots, this doesn't work since there is no `garden`
  namespace
- now, the `BackupBucket` controller maintains an annotation for the
  extension controller to know in which namespace the generated secret
  should be put

- we need the UID to be able to create a `BackupEntry` (the UID is used
  there)

We will reuse this in the `Shoot` API, and there is no need for having
the `Seed` prefix generally.

In the `controlPlane` section of the worker pool supposed to run the
control plane components, it is now possible to configure the backup
settings. For regular shoots, this does not work since the configuration
is part of the `SeedSpec`.

for autonomous clusters, otherwise continue to use backup config from
`Seed`

- configure backup in example `Shoot` manifest
- define dummy backup secret
- mount backup bucket directory into machine pods

- similar to extension resources

- improves readability

Similar to how `core.gardener.cloud/v1beta1.BackupEntry`s are handled,
the logic is now put into a component package.

Note for reviewers: It does not make much sense to write unit tests for
`health.CheckBackup{Bucket,Entry}` as these functions mainly call
`checkExtensionObject` which is already covered by the unit test of
`CheckExtensionObject`.