cilium-app: expose policyAuditMode; policy-drops observability

[weatherhog]

Part of #4338.

• Promote policyAuditMode from commented-out to a first-class documented value (default false; configmap template already guards with hasKey) so customers can set global.apps.cilium.values.policyAuditMode: true
• Document cluster-wide caveat (audit mode un-enforces existing denies too)
• Grafana dashboard for policy drops / opted-out namespaces in giantswarm/dashboards (Network Traffic Analysis dashboard already has CNP-change annotations; OBI/network-monitoring is Atlas-owned, reference only)