[lukepolo]

Fixes from the review of #698's Gateway API plugin installs.

• Only Ingresses actually on the cluster are retired, and not ones the new install renders itself: a fresh install or a re-run no longer waits up to two minutes on routes (a new https Gateway stays unaccepted until its certificate issues) or reports "retired" for nothing
• An install that renders no HTTPRoute never deletes the Ingresses it would replace
• The Gateway API install is used only when it has an overlay for the site's TLS mode: an https site with http-only routes keeps its certificate Ingress install instead of falling back to the shared self-signed one, and a proxied site with https-only routes keeps its http install instead of applying the plugin's root directory
• A site with no install for its TLS mode now stops with a message instead of applying the root