Make K8s cert-manager compatible

[lloesche]

Description

With this PR FIX CA supports K8s cert-manager style certificate issuer.

Example Issuer

apiVersion: cert-manager.io/v1
kind: ClusterIssuer
metadata:
  name: fix-ca-issuer
  namespace: cert-manager
spec:
  ca:
    secretName: fix-ca

Example Certificate

apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
  name: lukas-test-cert
  namespace: fix
spec:
  secretName: lukas-test
  duration: 2160h # 90d
  renewBefore: 360h # 15d
  commonName: lukas.test
  privateKey:
    algorithm: RSA
    encoding: PKCS1
    size: 2048
  usages:
    - server auth
    - client auth
  dnsNames:
    - redis.fix
  issuerRef:
    name: fix-ca-issuer
    group: cert-manager.io
    kind: ClusterIssuer

This PR also introduces a /ca/generate endpoint that creates a key and certificate signed by the CA. Clients with a valid JWT can access them through this endpoint. This should only be used if the client cannot produce their own key material and if they do not use the K8s Certificate CRD.

Code of Conduct

By submitting this pull request, I agree to follow the code of conduct.