cert-manager: step 1 of 7 — v1.14.0 to v1.15.5 (#0051)

Seven minors behind, and the documentation allows only one minor at a time with
the latest patch of each; skipping is offered solely as uninstall and reinstall.

Measured on the images rather than assumed: v1.14.0 carries 8 critical and 128
high findings across controller, webhook and cainjector; v1.21.1 carries 0 and
24. Both potentially breaking changes on the way were checked against our state
and do not apply — no dashboard or alert uses the ACME metrics whose label
changes, and nothing is bound to the cert-manager-edit ClusterRole whose
permissions narrow.

Fifteen certificates are Ready before this starts; that is the check after every
step.

apps/base/infra/cert-manager.yaml

@@ -9,7 +9,13 @@ spec:
   chart:
     spec:
       chart: cert-manager
-      version: "v1.14.0" # Oder aktuellste stabile Version
+      # Schrittweise auf v1.21.1 (management #0051). cert-manager verlangt
+      # "one minor version at a time, always the latest patch" - Ueberspringen
+      # ist nur ueber Deinstallation+Neuinstallation vorgesehen.
+      # Weg: 1.15.5 -> 1.16.5 -> 1.17.4 -> 1.18.6 -> 1.19.6 -> 1.20.3 -> 1.21.1
+      # Am Zielimage gemessen: v1.14.0 traegt 8 CRITICAL und 128 HIGH ueber die
+      # drei Images, v1.21.1 traegt 0 und 24.
+      version: "v1.15.5"
       sourceRef:
         kind: HelmRepository
         name: jetstack