fix(observability): gate needsCR on targetAllocator enabled

$needsCR granted the monitoring.coreos.com SM/PM read rule whenever any agent
had prometheusCR.enabled, even if that agent's targetAllocator was disabled, so
a stale prometheusCR.enabled over-granted. Mirror $needsTA by also requiring
targetAllocator.enabled, keeping the ClusterRole least-privilege. The otelCI
scrape path ($otelCIScrape) still grants it as before.

Author: wenegiemepraise

charts/amazon-cloudwatch-observability/templates/target-allocator-clusterrole.yaml

@@ -12,7 +12,7 @@
 {{- if or (and (hasKey ($customAgent.prometheus) "targetAllocator") (hasKey ($customAgent.prometheus.targetAllocator) "enabled") $customAgent.prometheus.targetAllocator.enabled) $otelCIScrape }}
 {{- $needsTA = true }}
 {{- end }}
-{{- if or (and (hasKey ($customAgent.prometheus) "targetAllocator") (hasKey ($customAgent.prometheus.targetAllocator) "prometheusCR") $customAgent.prometheus.targetAllocator.prometheusCR.enabled) $otelCIScrape }}
+{{- if or (and (hasKey ($customAgent.prometheus) "targetAllocator") (hasKey ($customAgent.prometheus.targetAllocator) "enabled") $customAgent.prometheus.targetAllocator.enabled (hasKey ($customAgent.prometheus.targetAllocator) "prometheusCR") $customAgent.prometheus.targetAllocator.prometheusCR.enabled) $otelCIScrape }}
 {{- $needsCR = true }}
 {{- end }}
 {{- end }}