Update DCA CNP for kube-apiserver egress

[tbavelier]

What this PR does / why we need it:

• Updates CNP for Cluster Agent for kube-apiserver egress by removing toServices and solely relying on toEntities for kube-apiserver

Which issue this PR fixes

• combining ToEntities and ToServices is not supported yet

• Same as Generated CiliumNetworkPolicy is invalid datadog-operator#1930, more details in update cluster agent cilium network policy datadog-operator#1948

Special notes for your reviewer:

Checklist

[Place an '[x]' (no spaces) in all applicable fields. Please remove unrelated fields.]

• Chart Version semver bump label added (use <chartName>/minor-version, <chartName>/patch-version, or <chartName>/no-version-bump)
• For datadog or datadog-operator chart or value changes, update the test baselines (run: make update-test-baselines)

GitHub CI takes care of the below, but are still required:

• Documentation has been updated with helm-docs (run: .github/helm-docs.sh)
• CHANGELOG.md has been updated
• Variables are documented in the README.md