fix(kafka): treat tls.enabled=null as unset in Kafka CR template

When tls.enabled is present in values but set to null, the previous
logic treated it as explicit (hasKey returned true), assigned null to
$tlsEnabled, and rendered tls: null on the external listener — an
invalid Strimzi CR field value.

Introduce $tlsEnabledRaw and guard the explicit check with an
additional ne nil condition so that null behaves like an absent key
and falls back to inheriting from .Values.external.

Assisted-By: Claude <noreply@anthropic.com>
Signed-off-by: Arsolitt <arsolitt@gmail.com>

packages/apps/kafka/templates/kafka.yaml

@@ -12,10 +12,11 @@
   Internal TLS listener (port 9093) is always on; Strimzi manages the PKI.
 */ -}}
 {{- $tlsMap := .Values.tls | default dict -}}
-{{- $tlsEnabledExplicit := hasKey $tlsMap "enabled" -}}
+{{- $tlsEnabledRaw := index $tlsMap "enabled" -}}
+{{- $tlsEnabledExplicit := and (hasKey $tlsMap "enabled") (ne $tlsEnabledRaw nil) -}}
 {{- $tlsEnabled := false -}}
 {{- if $tlsEnabledExplicit -}}
-  {{- $tlsEnabled = index $tlsMap "enabled" -}}
+  {{- $tlsEnabled = $tlsEnabledRaw -}}
 {{- else -}}
   {{- $tlsEnabled = .Values.external | default false -}}
 {{- end -}}