Add cert-manager CA

This adds a ClusterIssuer CA -- that is, a self-signed CA that is
available cluster-wide.  We'll use it to create SSL certs for use
with Zookeeper.  It needs to be cluster wide so we can use it in
both the zookeeper and zuul namespaces.

Change-Id: Ifce333ce6edbe2290e7f187dff5e684e75ea645f