feat(helm): support Cloud configuration and finalizer permissions

[labuladong]

Cloud's direct operator installation needs to preserve its environment settings and retain CRDs when an Argo Application is removed. Expose controllerManager.extraEnv / extraEnvFrom, admission-webhook.admissionWebhook.crdAnnotations, and an optional cert-manager certificate Common Name, so consumers can configure these through values without patching the upstream chart. Include the annotation block in the CRD template generator. Restore the Function/Source/Sink finalizer get/update permissions already declared by the controller RBAC markers and granted by the published OLM bundle.

Related to SNIP-176 and product-roadmap#1460. Cloud values and infrastructure wiring are separate follow-ups.

Validation:

• Strict Helm lint passes with defaults and configured overrides.
• Default manifests are unchanged except for the three finalizer resources gaining get/update; the optional configuration fields are no-ops by default.
• Configured renders verify environment variables, Secret references, retention annotations on all five CRDs, and the certificate Common Name with unchanged Service DNS SAN.
• Shell syntax and git diff --check pass.
• Independent review and simplification found no required changes.

No operator code or runtime defaults change. No cluster deployment was performed.

[github-actions]

@labuladong:Thanks for your contribution. For this PR, do we need to update docs?
(The PR template contains info about doc, which helps others know more about the changes. Can you provide doc-related info in this and future PR descriptions? Thanks)