add `RootShard` condition `IssuerExists`

[embik]

RootShard objects should have a condition signalling if the Issuer (or ClusterIssuer) used for its PKI exists.

[xrstf]

Do we truly want this? What would be the upside?

The downsides to make this working:

• The operator to watch (not just list) ClusterIssuers and Issuers, because it needs to react to those being created later (e.g. after the RootShard object). Otherwise the conditions on our objects will be out-of-date.
• This then requires additional cluster-wide permissions for the operator.
• The operator itself doesn't require the issuer, it only puts the reference on each created certificate (compared to, for example, the rootShardRef on a Shard object, where to reconcile a Shard we need the rootShard object).