Don't drop legacy apparmor annotations from cilium daemonset when upgrading to 1.30

[brandond]

RKE2 tracking issue for:

• Cilium Agent fails on Fedora Core 40 if SELinux is enabled cilium/cilium#34068
• AppArmor fields dropped from higher-level workload spec (daemonset / replicaset / etc) if modified on skewed cluster kubernetes/kubernetes#129511

Possible fixes on our side would be:

1. Wait for all control-plane nodes to be on the same version before deploying charts. This could introduce additional fragility and is not planned at this time.
2. Wait for new fields to be available for at least one minor version before using them.

We could keep the new field around for happy-path upgrades, but we should modify the chart postpone the migration to 1.31 to handle this corner case where the daemonset spec is round-tripped through a down-level apiserver that doesn't understand the annotation -> field migration.