Support customer-managed PKI issuers

[nv-lacm]

Description

Support self-managed NVCF deployments that use an existing cert-manager
installation and customer-managed PKI issuer.

Definition of Done

• NVCF can use an existing Issuer or ClusterIssuer without installing
  or upgrading cert-manager.
• Customer-owned issuer configuration is documented.

Resolution

PR #586 added the issuer ownership model, external Issuer and
ClusterIssuer support, external cert-manager support, render validation, and
operator documentation.

The following optional or runtime-hardening work is tracked separately and does
not block this issuer-support issue:

• feat(stargate): reject unsupported server identities in secure mode #946 rejects missing, implicit, and explicitly self-signed Stargate server
  identities in strict mode.
• feat(self-managed): support a pre-created LLM request-router TLS Secret #947 adds optional support for a pre-created request-router TLS Secret.

Related

Relates to #19.

Implemented by #586.

[mikeyrcamp]

PR #586 delivered the customer-managed issuer ownership contract and
documentation covered by this issue.

The remaining concerns have been split into focused follow-ups:

• feat(stargate): reject unsupported server identities in secure mode #946 tracks strict Stargate server identity validation.
• feat(self-managed): support a pre-created LLM request-router TLS Secret #947 tracks the optional pre-created request-router TLS Secret mode.

Closing #51 as completed.