[backport-1.4]: cert-manager can't be disabled on workload clusters (validating-admission-policies unit dependency)

A solution for issue #3114 (closed) needs to be backported to 1.4.x