fix: make ingress.className value optional

In order to be backwards-compatible with old controllers, cannot set
ingressClassName on the Ingress. And we cannot rely on having having the
ability to list IngressClass resources, as this is a new cluster level
permission that needs its own RBAC. Instead, we just expose the value
and use it for both the annotation kubernetes.io/ingress.class AND the
ingressClassName field on the Ingress resource.