HelmReleases fail when istioCNI is enabled due to istio-validation init container race condition

Any HelmRelease whose pods include the istio-validation init container can fail to deploy when istioCNI is enabled if they are created before the istioCNI pods are healthy. This could be fixed by making every HelmRelease that depends on istiod instead depend on istio-cni when the istioCNI package is enabled.