refactor: construct mutation dependencies only when mutation operations run

[longxiucai]

What this PR does / why we need it:

Part of the controller dependency cleanup tracked in #3964.

setupControllers always constructs the mutation system, and
pkg/controller/mutators/instances.Adder.Add creates the
conflict-routing channels and registers the routeConflictEvents
runnable before the individual mutator controllers check
mutation.Enabled(). Non-mutation processes therefore carry an unused
mutation system and runnable.

Changes:

• Construct the mutation system only when a mutation operation is
  assigned (mutation.Enabled()), via a small helper that is unit
  tested.
• Wire the external-data provider cache and client cert watcher into
  the mutation options only in that case; they keep serving the
  validation client independently.
• Return from the instances Adder before creating any conflict-routing
  state when mutation is disabled.

Workload expansion remains safe: expansion.System already accepts a
nil mutation system and skips applying mutators, which is covered by
the existing expansion tests.

Which issue(s) this PR fixes:

Fixes #4772

Special notes for your reviewer:

• TestNewMutationSystem covers mutation-disabled and mutation-enabled
  operation sets; the disabled case fails if unconditional construction
  is restored.
• TestAddSkipsSetupWhenMutationDisabled proves the instances Adder
  returns before touching the manager when mutation is disabled.
• go test ./pkg/mutation/... ./pkg/expansion/... passes.

[longxiucai]

Closing in favor of #4777, which covers the same change and was opened first. No need to review this one.