Move the operator's startup checks for Enterprise into pkg/enterprise

[caseydavenport]

Description

Continues moving Enterprise-only logic behind the extensions boundary, this time the startup checks that run before any controller starts. Three of them move into the Enterprise package as plain functions that main calls:

• verifying the Enterprise CRDs are installed
• the Elasticsearch internal/external certificate check
• which namespaces the operator refuses to install itself into

All three now have unit tests, where they previously had none.

Small behavior changes that fell out of it:

• The Elasticsearch certificate check ran twice on cloud builds, from two near-duplicate copies of the same code. It runs once now.
• Calico installs ran that check too, where it was always a no-op since the secrets only exist for Enterprise. Skipped there now.
• Dropped "calico-apiserver" from the refused namespaces, since nothing uses that namespace anymore.

Release Note

None