We need to detect the case where we deploy a Helm-based unit in workload cluster and this unit defines has `kustomization_spec.healthChecks` specified. This is indeed bogus because this will lead to doing the health check in mgmt cluster (unlike kustomize-based units, which have their kubeconfig point to the workload cluster, the Kustomization kubeconfig of a Helm-based unit point to the mgmt cluster, because the HelmRelease is deployed there). This problem came many times in the past (e.g. recently on neuvector: #4034), and we need something to catch it.