Initialize violation export dependencies only when export is enabled #4774

Parent issue: #3964

Describe the solution you'd like

Gatekeeper should construct and inject the violation export system only when --enable-violation-export=true.

setupControllers currently calls export.NewSystem() for every operation set. The export connection controller already skips registration when export is disabled, and the audit manager only publishes when the flag is enabled, so the default-disabled case carries an unused dependency.

This task should remain feature-gated rather than assuming that the export connection controller must share a particular operation pod.

Suggested scope:

• Construct export.System only when violation export is enabled.
• Register and inject the export dependency only into enabled consumers.
• Keep the audit publishing and Connection reconciliation paths working when export is enabled.
• Fail clearly during setup if export is enabled but a required export dependency is absent; do not silently skip requested functionality.

Acceptance criteria:

• With violation export disabled, no export system or export connection controller is initialized.
• With violation export enabled, audit publishing and Connection reconciliation receive a non-nil export system and retain current behavior.
• Enabling export with an invalid dependency configuration fails during setup rather than producing a later nil dereference.
• Focused enabled/disabled tests fail when unconditional construction is restored.

Environment:

• Gatekeeper version: current master
• Kubernetes version: not version-specific