cert-manager: step 6 of 7 — v1.19.6 to v1.20.3 (#0051)

This is the step with the RBAC narrowing: the cert-manager-edit aggregate
ClusterRole no longer grants create on challenges or create, patch and update on
orders. Those resources belong to cert-manager's own ACME workflow. Nothing here
is bound to that ClusterRole — zero bindings across all namespaces — so no
tooling loses a permission it was using.

Previous step verified: three deployments on v1.19.6, fifteen certificates
Ready.

apps/base/infra/cert-manager.yaml

@@ -15,7 +15,7 @@ spec:
       # Weg: 1.15.5 -> 1.16.5 -> 1.17.4 -> 1.18.6 -> 1.19.6 -> 1.20.3 -> 1.21.1
       # Am Zielimage gemessen: v1.14.0 traegt 8 CRITICAL und 128 HIGH ueber die
       # drei Images, v1.21.1 traegt 0 und 24.
-      version: "v1.19.6"
+      version: "v1.20.3"
       sourceRef:
         kind: HelmRepository
         name: jetstack