Fix system-workspace shouldn't be controled by kubefed

Created by: RolandMa1986

Add kubefed.io/managed: "false" to system-workspace, so it won't be controlled by Federated Workspaces.

1. Added kubefed.io/managed: "false" to WorkspaceTemplate, since Workspace resource is a copy of WorkspaceTemplate in a single cluster or initial cluster the first time.
2. Added Workspace to cover upgrade scenario when upgrade member cluster.

Related: kubesphere#3772 (closed)