Allow deletion of not yet reconciled zones

[timebertt]

How to categorize this issue?

/area usability
/kind enhancement
/priority normal
/platform aws

What would you like to be added:

Currently, validator-aws forbids removal of zones from a Shoot's infrastructureConfig / workers[].zones.
This is, because it can't know

• a) if the resources for those removed zones (subnet, security groups, etc.) have already been created
  • but if they haven't been created yet, it would actually be safe to remove a zone
• b) if a removed zone is empty and can be deleted safely (no machines/other resources left in subnet/zone)

We would like to lift restriction a) and allow removal of zones, that have not been created yet.
This would require that the infrastructure actuator reports back to the garden cluster, what resources (e.g. subnets) have been created for a given Infrastructure object.

Why is this needed:

This will allow endusers to help themselves and fix a broken Shoot spec, for example when they try to add a zones with a CIDR that conflicts with another existing subnet in the VPC. In that case, the addition of the zone succeeds, but the infrastructure reconciliation will fail and the Shoot will be in Failed state, but the zone cannot be removed, although it is "empty" and could be removed safely.