Bug?: (Helm) unable to add rule to previously created (default) firewall

Nobody has claimed this yet.

The helm template for the `CloudFirewall` has one big `if` statement around it:

https://github.com/linode/cloud-firewall-controller/blob/8eae0593716403589d4b070840967399b0b153d7/helm/controller/templates/firewall.yaml#L1-L1

This means that if you install the helm chart with default values, no (Helm managed) `CloudFirewall` will be created. However the Golang controller code will create a default firewall if no `CloudFirewall` exists:

https://github.com/linode/cloud-firewall-controller/blob/8eae0593716403589d4b070840967399b0b153d7/internal/controller/cloudfirewall_controller.go#L660-L679

Later on adding a rule via Helm however will now fail, because it will try to create a _Helm managed_ `CloudFirewall` (see above) where the object already exists. Helm will fail with:

```
╷
│ Error: Unable to continue with update: CloudFirewall "primary" in namespace "kube-system" exists and cannot be imported into the current release: invalid ownership metadata; label validation error: missing key "app.kubernetes.io/managed-by": must be set to "Helm"; annotation validation error: missing key "meta.helm.sh/release-name": must be set to "cloud-firewall-controller"; annotation validation error: missing key "meta.helm.sh/release-namespace": must be set to "kube-system"
│
│ with helm_release.linode_firewall_controller,
│ on main.tf line 70, in resource "helm_release" "linode_firewall_controller":
│ 70: resource "helm_release" "linode_firewall_controller" {
│
╵
```

Note: the above is actually a failure of Helm wrapped in Terraform because I'm doing the `helm install` via Terraform, but that's besides the point. Helm is correct in the sense that because the original `CloudFirewall` was not created by Helm previously, it should not suddenly manage it and will therefor fail.

Start with helm/controller/templates/firewall.yaml and internal/controller/cloudfirewall_controller.go around the linked lines. Compare the Helm ownership metadata with the controller-created default CloudFirewall, then reproduce installing with default values followed by adding a rule. Done means that workflow no longer fails because Helm cannot adopt the existing firewall.

Written by the indexing model from the issue text.