Deploy shoot-cert-service on garden runtime cluster

[MartinWeindel]

How to categorize this PR?

/area control-plane
/kind enhancement

What this PR does / why we need it:
With the introduction of operation extensions, it is possible to deploy an extension on the Garden runtime cluster.
Adjustments both to the deployment of the shoot-cert-service itself and the deployment of the cert-management are needed to deal with the different environment on the Garden runtime cluster. In contrast to the deployment in the shoot namespace on the seed, deploy host and target are the same here. Moreover, some features like shootIssuers, dnsChallengeOnShoot, alerting are not relevant in this context. Prometheus scraping and Plutono dashboards are also not supported.

Addtionally, the default issuer can now be a CA issuer instead a ACME issuer to support test and private cloud scenarios.

The management of "controlplane-cert" TLS secrets for the runtime cluster and the seeds can be enabled optionally.
On the runtime cluster, this includes fetching the domain names from the Garden resources, creating the Certificate resource, requesting the certificate via its own cert-controller-manager and patching the virtual-garden-kube-apiserver deployment.
On the seed clusters, there is also an own cert-controller-manager. A Certificate is created for the wildcard subdomain *. of the seed ingress domain.

Which issue(s) this PR fixes:
Fixes #

Special notes for your reviewer:
Part of gardener/gardener#9635

Release note:

Support for deploying the shoot-cert-service extension on the Garden runtime cluster.

Support for using a `CA` issuer as default issuer.

Management of `controlplane-cert` TLS secrets on runtime cluster and seeds.

[timuthy]

/assign

[marc1404]

/assign