hack/*: use kubectl apply where possible

There is an issue with kubectl apply and third party resources, so for
the time being we use create for TPRs, but apply for all manifests that
it can handle.