added a shared authserviceEnabled helper then wired authservices resources to use it

General MR

Summary

I added a shared authserviceEnabled helper in _helpers.tpl (line 730), then wired authservice’s HelmRelease, GitRepository, Namespace, image pull Secret, and values Secret to use it. The helper now includes the Thanos SSO case, so addons.thanos.enabled=true plus addons.thanos.sso.enabled=true renders the authservice resources even when addons.authservice.enabled=false.

I also updated Istiod and Thanos values wiring so Istiod enables the authservice extension provider and Thanos allows the needed authservice egress/ambient waypoint behavior. Added focused coverage in thanos-sso_test.yaml.

Also fixed istio-cni git repo path for consistency

Relevant logs/screenshots

N/A

Linked Issue

Closes #3295 (closed)

Upgrade Notices

N/A