injector.failurePolicy = "Fail" prevents the injector from starting if there is no namespaceSelector

**Describe the bug**
If one sets `injector.failurePolicy = "Fail"` installing the helm chart succeeds, however if for some catastrophic failure all injector replicas go down, the deployment is stuck as it cannot start new pods as they are blocked.

I've worked around this by setting a `namespaceSelector` that ensures that the namespace the chart is installed in is excluded

Separately, the documentation here is incorrect - https://www.vaultproject.io/docs/platform/k8s/injector/installation#namespace-selector as it states that if you don't set `namespaceSelector` it will exclude `kube-system` and `kube-public` which isn't true.

**To Reproduce**
Steps to reproduce the behavior:
1. Install chart with `injector.failurePolicy = "Fail"`
2. `kubectl scale deployment vault-agent-injector --replicas=0`
3. `kubectl scale deployment vault-agent-injector --replicas=2`
4. Observe that the deployment with stuck now with 0 pods

**Expected behavior**
I am not sure if there is a good way to exclude the injector from its own webhook, but at least the documentation should state it clearly that one will need to exclude it themselves.

**Environment**
* Kubernetes version: 1.19
* Distribution or cloud vendor (OpenShift, EKS, GKE, AKS, etc.): EKS
* vault-helm version: 0.15.0

Chart values:

```yaml
injector:
agentImage:
tag: 1.5.4
failurePolicy: Fail
image:
tag: 0.12.0
replicas: 2
resources:
limits:
cpu: 250m
memory: 256Mi
requests:
cpu: 250m
memory: 256Mi

```

Start with the injector.failurePolicy and namespaceSelector chart values, then reproduce the behavior with the listed kubectl scale commands on Kubernetes 1.19. Review the namespace-selector documentation at the linked installation page and determine the expected exclusion behavior. Done means the injector can recover as described and the documentation accurately explains the required configuration.

Written by the indexing model from the issue text.