add workloadSelector for sidecar
General MR
Summary
Adds a workloadSelector to the Sidecar resource to ensure that the Sidecar is only applied to the Grafana pods within the monitoring namespace. Otherwise, if we applied the Sidecar in the monitoring namespace without the workloadSelector, all other monitoring components would not be able to reach cluster-external endpoints unless they also had istio.hardened.enabled: true set (and had the requisite ServiceEntries in place).
Relevant logs/screenshots
(Include any relevant logs/screenshots)
Linked Issue
Upgrade Notices
N/A