coco: Use cert-manager for SPIRE x509pop certificates #111
Description
We agreed during PR #80 review that cert-manager would be more kube-native than the current imperative ansible CronJob approach for certificate generation.
Moving to cert-manager would let us declare certificates as Custom Resources and have them automatically issued and renewed, instead of running an ansible job every 10 minutes.
The main challenge is that SPIRE consumes the CA certificate from a ConfigMap, while cert-manager outputs everything as Secrets. We need a bridging mechanism to sync the CA data into the expected ConfigMap format.