feat(admission) enable the webhook by default and release 2.16

[rainest]

What this PR does / why we need it:

From conversation earlier today, we noted that admission webhook is useful but not enabled by default in deploy manifests. Enabling it by default in the plain manifests is difficult because we know of no way to have Kustomize generate the certificate, but Helm can generate a certificate.

The admission webhook was not enabled by default, but AFAIK this was just a safe default we chose when the webhook was newer and possibly buggier. At this point, the webhook is stable, works well, and only rejects configuration that Kong cannot accept anyway, so we should just go ahead and turn it on.

There was furthermore a chart limitation where the default generated certificate would force a Deployment restart on every upgrade. We've since added functionality that avoids this by checking if a certificate exists on upgrade and leaving it as-is, rather than always generating a fresh certificate.

Releases 2.16.

Special notes

We should maybe see if we can get #722 in first, so holding this for a day or so to see if we can get that in as well.

Checklist

• PR is based off the current tip of the main branch.
• Changes are documented under the "Unreleased" header in CHANGELOG.md
• New or modified sections of values.yaml are documented in the README.md
• Commits follow the Kong commit message guidelines