Decide mutability of spec.security.trust.certManager.issuerRef

[mkolesnik]

If the user changes issuerRef.name after creation, existing Certificate resources still point to the old issuer.
The controller doesn't update them because ensureCertificateForCluster returns early if the Certificate exists.

Need to decide:

• Should issuerRef be immutable (like spec.clusterSet, see Add validating webhook for spec.clusterSet #97)?
• Should the controller detect the change and update existing Certificates?
• How does this interact with the designed Root CA rotation path (admin updates the Issuer's secret, not the mesh's issuerRef)?