[kube-prometheus-stack] Fix operator tls handling when admission webhooks are disabled

[firasmosbehi]

Summary

• fix Prometheus Operator TLS rendering when prometheusOperator.admissionWebhooks.enabled=false
• compute effective operator TLS as enabled only when a certificate source exists:
  • admission webhooks enabled, or
  • cert-manager admission certs enabled, or
  • prometheusOperator.tls.secretName explicitly set
• avoid mounting the generated *-admission secret when it is not created
• switch operator Service, ServiceMonitor, and operator network policies to the same effective TLS mode
• add prometheusOperator.tls.secretName to values for users who want TLS without admission webhooks
• add regression unit tests for deployment/service/servicemonitor behavior and bump chart version to 81.5.1

Closes #6586.

Testing

• helm unittest --strict --file 'unittests/**/*.yaml' charts/kube-prometheus-stack
• helm lint charts/kube-prometheus-stack
• GITHUB_SHA=$(git rev-parse HEAD) ct lint --config .github/linters/ct.yaml --charts charts/kube-prometheus-stack

[jkroepke]

If prometheusOperator.tls.enabled is set to true, I expect that the operator is configured with tls. Automatic behavior feels dangerous here.