Remove CABundle from CRDs if the cert is invalid

[stefanprodan]

Starting with Kubernetes 1.31, CRDs which have an invalid cert as the value of spec.conversion.webhook.clientConfig.caBundle are being rejected by the API. Since there are lots of CRDs with a dummy value for caBundle, these will fail to be reconciled even if cert-manager is configured to update the bundle to a valid one. To avoid this type of conflict, we should validate the bundle in the same way Kubernetes does it, and if the validation fails we need to remove the field from the SSA patch.

Xref:

• CRD validation allows invalid CABundles that will fail setting up handlers kubernetes/kubernetes#123835
• Validate CABundle when writing CRD kubernetes/kubernetes#124061