fix(tunnel-secret): Two owners for one resource

[rene-dekker]

Every 2.0s: kubectl get secret calico-management-cluster-connection -o yaml -n calico-system                                                                                                                                      
...
metadata:
  creationTimestamp: "2026-01-13T23:59:25Z"
  name: calico-management-cluster-connection
  namespace: calico-system
  ownerReferences:
  - apiVersion: operator.tigera.io/v1
    blockOwnerDeletion: true
    controller: true
    kind: APIServer
    name: tigera-secure
    uid: 88bcd287-6671-437b-9ef1-228659e66904
  resourceVersion: "182749"
  uid: ea542965-a729-4e32-945e-48614ac19ab0
type: Opaque

...

kind: Secret
metadata:
  creationTimestamp: "2026-01-13T23:59:25Z"
  name: calico-management-cluster-connection
  namespace: calico-system
  ownerReferences:
  - apiVersion: operator.tigera.io/v1
    blockOwnerDeletion: true
    controller: true
    kind: Manager
    name: tigera-secure
    uid: 313ddf8c-1d7f-4abd-99ce-c826b154d88a
  resourceVersion: "185440"
  uid: ea542965-a729-4e32-945e-48614ac19ab0
...

The primary controller responsible for this secret is the manager_controller, so we removed the creation logic from the apiserver_controller.

Fixed an issue caused by manager_controller and apiserver_controller both writing the calico-management-cluster-connection secret to calico-system causing constant reconciliations.