Kubernetes operator HA Ingress: don't delete TLS credentials while VIPService is still advertised

### What is the issue?

Currently, when an HA Ingress is created, we [provision a TLS Secret and RBAC](https://github.com/tailscale/tailscale/blob/fea74a60d529bcccbc8ded74644256bb6f6c7727/cmd/k8s-operator/ingress-for-pg.go#L912) for the proxies to be able to read/write certs to the Secret.
When an Ingress is deleted, we [clean up the Secret and the RBAC](https://github.com/tailscale/tailscale/blob/fea74a60d529bcccbc8ded74644256bb6f6c7727/cmd/k8s-operator/ingress-for-pg.go#L930) (alongside other resources created for the Ingress).
We actually do not wait for the proxy to unadvertise the Tailscale virtual service created for the Ingress, so it is possible that a backend is still receiving traffic for the HTTPS endpoint associated with the Ingress, but the certs are gone and clients are experience downtime till they get switched to a healthy backend.

We should instead wait for the service to be unadvertised and only then proceed with the TLS Secret and RBAC deletion.