Add a new issuer configuration to net-certmanager for system-internal-tls certificates

[ReToCode]

Changes

• Prerequisite for [cluster-local-domain-tls] create KnativeCertificate in Serving when cluster-local encryption is enabled knative/serving#14217
• Renames internal -> local to be aligned with renamed encryption flags
• Introduce a new issuer systemInternalIssuerRef to sign certificates for system-internal-tls
• Rename CA to knative-selfsigned-issuer to not conflict with system-internal-tls
• Use CertificateTypeLabelKey to distinguish between the three different certificate types
• Add a new label knative.dev/issuer-install to optionally filter out the selfsigned issuers when installing

/hold needs knative/networking#891 to be merged first
/hold wait for results of discussion in next Serving WG

/kind enhancement

Fixes knative/serving#14625

Release Note

net-certmanager now allows to sign certificates for the `system-internal-tls` feature

Docs
Will be added once the feature is completed end to end.

[knative-prow]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: ReToCode

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [ReToCode]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[ReToCode]

PTAL, I'll rebase and remove the go mod replace once the networking PR is merged.

/assign @nak3
/assign @skonto

[codecov]

Codecov Report

Attention: 12 lines in your changes are missing coverage. Please review.

Comparison is base (ad31c6f) 89.68% compared to head (73d6a11) 87.93%.
Report is 4 commits behind head on main.

Files	Patch %	Lines
.../certificate/resources/cert_manager_certificate.go	73.33%	8 Missing ⚠️
pkg/reconciler/certificate/config/cert_manager.go	55.55%	2 Missing and 2 partials ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main     #627      +/-   ##
==========================================
- Coverage   89.68%   87.93%   -1.76%     
==========================================
  Files           5        5              
  Lines         378      406      +28     
==========================================
+ Hits          339      357      +18     
- Misses         27       36       +9     
- Partials       12       13       +1     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

[nak3]

LGTM overall but we should add a conformance test in https://github.com/knative/networking/tree/main/test/conformance/certificate/nonhttp01 ?

[ReToCode]

/unhold

Networking PR is merged: knative/networking#891, conformance tests is tracked in knative/serving#13855. So this is ready to be reviewed again @dprotaso @nak3 @skonto

[skonto]

Tests pass at the Serving side besides the long standing issue with the http_serving tests flakiness.
/lgtm