chore(helm)!: change iptables default mode to nft

[alpeb]

This change sets as a new default nft for the proxyInit.iptablesMode and iptablesMode values in the linkerd-control-plane and linkerd2-cni helm charts. This doesn't imply any change in user-facing behavior.

This was prompted by EKS with k8s 1.33 no longer supporting the iptables legacy mode.

Further testing in multiple platforms with different k8s versions revealed nft mode is now broadly supported.

Upgrading via Helm will apply the new default, unless legacy mode was explicitly set during the initial install.

[olix0r]

=== RUN   TestInjectAutoPod
Error: TestInjectAutoPod - malformed init container
    inject_test.go:498: malformed init container:
        [Args.slice[0]: --ipv6=false != --firewall-bin-path Args.slice[1]: --incoming-proxy-port != iptables-nft Args.slice[2]: 4143 != --firewall-save-bin-path Args.slice[3]: --outgoing-proxy-port != iptables-nft-save Args.slice[4]: 4140 != --ipv6=false Args.slice[5]: --proxy-uid != --incoming-proxy-port Args.slice[6]: 2102 != 4143 Args.slice[7]: --inbound-ports-to-ignore != --outgoing-proxy-port Args.slice[8]: 4190,4191,1234,5678 != 4140 Args.slice[9]: --outbound-ports-to-ignore != --proxy-uid]
--- FAIL: TestInjectAutoPod (1.02s)