Fix istiod dep packages key

General MR

Summary

Big Bang umbrella:

• Fixed generic packages HelmRelease ordering.
• Packages receiving bbCommonValues now depend on istiod, even without explicit sidecar injection.
• Ambient packages additionally depend on istio-cni and ztunnel.
• Preserved opt-out behavior when both bb-common values and injection are disabled.
• Added sidecar, ambient, and opt-out tests.

This addresses the webhook race: Flux previously reconciled generic packages without waiting for istiod unless istio.injection: enabled was explicitly configured. Meanwhile, umbrella-generated bb-common values enabled Istio resources, causing validation requests before the webhook had endpoints.

Relevant logs/screenshots

n/a

Linked Issue

Closes #3373 (closed)

Upgrade Notices

N/A