apps: CA and TLS Secrets with private keys stay in the tenant namespace after the app is deleted #4704

cert-manager runs with enableCertificateOwnerRef: false, so a Certificate's Secret is not garbage-collected when the Certificate goes. For apps that mint their own CA and leaf through cert-manager (qdrant, for example: <release>-ca and <release>-tls, both holding tls.key), deleting the application leaves both key-bearing Secrets in the tenant namespace. They outlive the workload they protected, and a later app of the same name may reuse a key it did not create. The e2e leak guard checks pods only, so no suite fails on this. Found while writing the qdrant trust-anchor e2e (#4701). Fix shape: either enable the Certificate owner reference for these app-scoped Certificates (per Certificate via spec.secretTemplate or globally, after checking what else relies on the current behaviour), or delete the Secrets in each app's uninstall path, and extend the leak guard to Secrets an app created.