Upgrade vendored cert-manager and external-dns charts

[jorgemoralespou]

Summary

Bumps the two remaining vendored upstream cluster-service charts the
installer operator ships, and carries the follow-on changes those bumps
required.

Cluster-service charts

Chart	Chart version	App version
cert-manager	v1.20.3 → v1.21.2	cert-manager v1.20.3 → v1.21.2
external-dns	1.21.1 → 1.22.0	external-dns 0.21.0 → 0.22.0

Followed the educates-upgrade-cluster-services protocol: VENDORED_CHARTS
(Makefile), SHA256SUMS, embed.go constants and the on-disk tarballs all
move together, tarballs re-vendored through make vendor-charts (hash
verified) and the old ones removed. The helm load test that hardcodes the
cert-manager version and the vendored-charts README table are updated.

Reconciler assumptions re-verified by rendering both new charts:

• cert-manager still renders the cert-manager, cert-manager-webhook
  and cert-manager-cainjector Deployments and still honours the
  crds.enabled / crds.keep / startupapicheck.enabled values
  renderCertManagerValues sets. The 1.21 chart drops the default
  tokenrequest Role/RoleBinding, restricts create on Orders/Challenges in
  cert-manager-edit, and removes the ServiceMonitor targetPort / path
  values; the operator sets and uses none of those. The three v1.21.0
  regressions (controller panic with renewal.policy: Disabled, Secret
  informer log spam, Issuers stuck InvalidSolver) are fixed in v1.21.1.
• external-dns still renders the single external-dns Deployment.
  Chart 1.22.0 makes policy a required value (the reconciler already sets
  sync) and replaces the hardcoded replica count with a replicaCount
  value bounded to 0..1, left at the default; the reconciler comments are
  updated to match.

Regenerating the fine-grained installer RBAC produced no diff.

external-dns annotation prefix

external-dns 0.22.0 reads annotations under the external-dns.kubernetes.io/
prefix by default and no longer reads external-dns.alpha.kubernetes.io/;
each release reads exactly one prefix (--annotation-prefix) with no
fallback either way. The Contour reconciler now sets the wildcard hostname on
the Envoy Service under both keys:

• the new key is what the bundled 0.22.0 reads;
• the old key keeps a user-run external-dns older than 0.22 working, and
  keeps the wildcard record alive during an in-place upgrade of the bundled
  release (Contour is reconciled before external-dns, so the annotation
  swap would otherwise land while the old external-dns is still running
  with policy: sync).

The old key is marked deprecated in the release notes for removal in a later
release. The release notes also warn that resources users annotate themselves
for the bundled external-dns (for example when sources includes ingress)
must move to the new prefix. The installation architecture guide describes
both keys.

Other 0.22.0 changes reviewed: on Route53 the ownership TXT records for alias
A records move from a cname- to an a- prefix (upstream migrates them
automatically; leftover cname- records can be cleaned with upstream's
script). The removed providers (Akamai, Plural, Transip) and Pi-hole v5 are
not reachable through the CRD, which only offers Route53 and CloudDNS.

OperationalBlock doc comment

The OperationalBlock doc comment in the config API cited "external-dns
1.21.1 hardcodes replicas to 1 and exposes no replica value", which no longer
holds. It is rewritten in terms of the charts as vendored today, the
KyvernoConfig comment that pointed at the same history is tightened, and
the CRD (chart, operator embed, CLI embed) plus the CLI EducatesConfig
schema are regenerated from it.

Testing

• make -C installer/operator verify-vendored-charts — all four tarball
  hashes verify.
• make -C installer/operator test — passes, including
  TestVendoredCharts_DirectoryConsistent, the per-chart _Embedded tests
  and the envtest suites.
• make generate-installer-rbac + make embed-installer-chart — no drift.
• make ci-cli — passes (build, tests, installer-chart embed and CLI schema
  drift checks).
• Not exercised on a real cluster: verifying DNSReady with the new
  annotation keys needs a Managed-mode install against a Route53 or CloudDNS
  zone.