fix: emit correct Istio pod labels for ambient mode

[fantapsody]

Summary

Two fixes for Istio ambient mode support in sn-platform-slim:

1. Emit correct pod labels for ambient mode (_helpers.tpl)

• When istio.dataplaneMode is "ambient", the pulsar.template.labels helper now emits istio.io/dataplane-mode: "ambient" instead of the default sidecar.istio.io/inject: "true"
• Prevents sidecar injection for pods that should use Istio ambient mesh (ztunnel)
• Fixes both operator-managed components (where the Helm label conflicted with the operator's CRD-driven label) and Helm-only components (toolset, function-worker, grafana, console, etc.)

2. Decouple broker Istio mesh enrollment from ingress config (broker-cluster.yaml)

• Split the broker's spec.istio conditional so base settings (enabled, dataplaneMode, mtls) only require istio.enabled, while the gateway block additionally requires ingress.broker.enabled
• Previously the entire spec.istio was gated behind both conditions, so users couldn't enable mesh enrollment without also enabling broker ingress
• This was inconsistent with ZK, BK, and Proxy templates which only check istio.enabled

The existing istio.labels custom override still takes highest precedence, preserving backward compatibility.

Test plan

• helm template verified correct label output for all three modes: ambient, sidecar (default), sidecar (explicit)
• helm template verified broker CRD outputs correct spec.istio with and without ingress.broker.enabled
• E2E tested on minikube with Istio ambient profile: all pods 1/1 (no sidecars), correct istio.io/dataplane-mode: ambient labels, produce/consume verified
• Verify no regression for existing sidecar-mode deployments

🤖 Generated with Claude Code

[github-actions]

@fantapsody:Thanks for your contribution. For this PR, do we need to update docs?
(The PR template contains info about doc, which helps others know more about the changes. Can you provide doc-related info in this and future PR descriptions? Thanks)

[maxsxu]

PR Review

Summary of Changes

This PR addresses an issue where Istio configurations for the broker were previously coupled with the ingress.broker.enabled flag.

• It correctly decouples the istio configuration block from the ingress requirement, ensuring that Istio settings (such as dataplaneMode and mtls.mode) can be applied regardless of whether the broker ingress gateway is enabled.
• The PR also adds the istio.io/dataplane-mode: "ambient" label to pods when the dataplane mode is set to "ambient".

Review

The changes look good and correctly resolve the configuration dependency issue. The logic for applying the ambient label and conditionally rendering the Istio gateway block is sound.

Approving the PR.