include cert-manager in the uds-core packages meant for prod

[cmwylie19]

Is your feature request related to a problem? Please describe.

We have seen a few cases where the certs have expired on the admission hooks when envs fall behind on regular updates.

Describe the solution you'd like

• Given UDS is deployed
• When the admission certs expire
• Then they are rotated

[linear]

Tracked in CORE-486.

[mjnagel]

Related to defenseunicorns/pepr#3019 , zarf-dev/zarf#4767 , and zarf-dev/zarf#3367

Cert-manager feels like a heavy solution for 2 self-signed webhook certs and I'd love to eval simpler approaches here - including finding ways to shift this left/upstream. One thought is that we could potentially use an OnSchedule with Pepr to cycle the certs every 30 days (or some other frequency/trigger) for both Pepr and Zarf. This could be a disruptive operation so we'd want to make sure to test the impact.