[backport-1.5]: cert-manager can't be disabled on workload clusters (validating-admission-policies unit dependency)

A solution for issue #3114 (closed) needs to be backported to 1.5.x