Automatic merge from submit-queue

Fix watch cache filtering

When serving watch events for a particular namespace, the watch cache filters out events from other namespaces by checking the etcd key of the event's object, and making sure it is prefixed with the root key for the namespace being watched.

The prefix check does not ensure the match occurs on a path segment boundary, so a watch on  namespace `test` is delivered watch events for namespace `test1`.

This tightens the check to ensure the prefix match occurs on a path segment boundary.