kapp-controller failing to start when isitio proxy is enabled on the namespace

**What steps did you take:**

1. Install kapp-controller on your cluster, kapp-controller will be running with 1 container
2. Install [istio-/proxy](https://github.com/istio/proxy) v1.13 in your cluster
3. Enable istio injection on the namespace where kapp-controller is running
4. Manually delete the kapp-controller pod so that istio/proxy can be injected into it
5. Now you will notice the kapp-controller pod has 2 containers (1 kc and other of istio proxy side car). The kapp-controller container fails to come up with the following error -

```
{"level":"info","ts":1647424851.3420548,"logger":"kc.main","msg":"kapp-controller","version":"0.30.0"}
{"level":"info","ts":1647424851.3424857,"logger":"kc.init","msg":"start init"}
{"level":"info","ts":1647424851.3504808,"logger":"kc.init","msg":"starting zombie reaper"}
{"level":"info","ts":1647424851.4911575,"logger":"kc.main","msg":"kapp-controller","version":"0.30.0"}
{"level":"info","ts":1647424851.4914856,"logger":"kc.controller","msg":"start controller"}
{"level":"info","ts":1647424851.4915998,"logger":"kc.controller","msg":"setting up manager"}
I0316 10:00:53.493011 12 request.go:645] Throttling request took 1.044402152s, request: GET:[https://10.245.0.1:443/apis/admissionregistration.k8s.io/v1?timeout=32s](https://10.245.0.1/apis/admissionregistration.k8s.io/v1?timeout=32s)
{"level":"info","ts":1647424854.7012618,"logger":"controller-runtime.metrics","msg":"metrics server is starting to listen","addr":":8080"}
{"level":"info","ts":1647424854.702086,"logger":"kc.controller","msg":"setting up controller"}
{"level":"info","ts":1647424854.7249172,"logger":"kc.controller","msg":"setting up metrics"}
I0316 10:00:55.820692 12 serving.go:325] Generated self-signed cert (/home/kapp-controller/kc-agg-api-selfsigned-certs/kapp-controller.crt, /home/kapp-controller/kc-agg-api-selfsigned-certs/kapp-controller.key)
I0316 10:00:55.822394 12 apiserver.go:190] Syncing CA certificate with APIServices
{"level":"error","ts":1647424855.8656304,"logger":"kc.main","msg":"Exited run with error","error":"Building API server: error updating api service with generated certs: error updating kapp-controller CA cert of APIService v1alpha1.data.packaging.carvel.dev: Operation cannot be fulfilled on apiservices.apiregistration.k8s.io \"v1alpha1.data.packaging.carvel.dev\": the object has been modified; please apply your changes to the latest version and try again","stacktrace":"github.com/go-logr/zapr.(*zapLogger).Error\n\tgithub.com/go-logr/zapr@v0.2.0/zapr.go:132\nmain.main\n\t./main.go:44\nruntime.main\n\truntime/proc.go:255"}
{"level":"error","ts":1647424855.8730576,"logger":"kc.init","msg":"Could not start controller","error":"exit status 1","stacktrace":"github.com/go-logr/zapr.(*zapLogger).Error\n\tgithub.com/go-logr/zapr@v0.2.0/zapr.go:132\ngithub.com/vmware-tanzu/carvel-kapp-controller/cmd/controllerinit.Run\n\tgithub.com/vmware-tanzu/carvel-kapp-controller/cmd/controllerinit/run.go:38\nmain.main\n\t./main.go:51\nruntime.main\n\truntime/proc.go:255"}
```

**What happened:**

The kapp-controller container is failing to come up when the istio proxy side car container is running along with it

**What did you expect:**

Expect the kapp-controller container to run as expected

**Anything else you would like to add:**
[Additional information that will assist in solving the issue.]

**Environment:**

- kapp Controller version (execute `kubectl get deployment -n kapp-controller kapp-controller -o yaml` and the annotation is `kbld.k14s.io/images`):

kapp-controller version - v0.30.0

- Kubernetes version (use `kubectl version`)

k8s version - v1.21.1

---
Vote on this request

This is an invitation to the community to vote on issues, to help us prioritize our backlog. Use the "smiley face" up to the right of this comment to vote.

👍 "I would like to see this addressed as soon as possible"
👎 "There are other more important things to focus on right now"

We are also happy to receive and review Pull Requests if you want to help working on this issue.