feat: use kube-utils certmanager for webhook certificate auto-rotation

[ColdsteelRail]

• Replace manual certificate generation with kube-utils/webhook/certmanager
• Add volumeMounts in Helm chart for webhook-certs Secret
• Unify Secret name to "webhook-certs" (matching Helm chart)
• Auto-detect and rotate expired certificates
• Add design plan document in docs/plans/

Fixes TLS handshake timeout issue when Helm updates controller.

1. Does this PR affect any open issues?(Y/N) and add issue references (e.g. "fix #123", "re #123".):

• N
• Y

2. What is the scope of this PR (e.g. component or file name):

3. Provide a description of the PR(e.g. more details, effects, motivations or doc link):

• Affects user behaviors
• Contains syntax changes
• Contains variable changes
• Contains experimental features
• Performance regression: Consumes more CPU
• Performance regression: Consumes more Memory
• Other

4. Are there any breaking changes?(Y/N) and describe the breaking changes(e.g. more details, motivations or doc link):

• N
• Y

5. Are there test cases for these changes?(Y/N) select and add more details, references or doc links:

• Unit test
• Integration test
• Benchmark (add benchmark stats below)
• Manual test (add detailed scripts or steps below)
• Other

6. Release note

Please refer to Release Notes Language Style Guide to write a quality release note.

None

[codecov]

Codecov Report

❌ Patch coverage is 0% with 15 lines in your changes missing coverage. Please review.
✅ Project coverage is 47.23%. Comparing base (101f952) to head (3ce229c).
⚠️ Report is 1 commits behind head on main.

Files with missing lines	Patch %	Lines
pkg/webhook/webhook.go	0.00%	15 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main     #356      +/-   ##
==========================================
+ Coverage   46.23%   47.23%   +0.99%     
==========================================
  Files         123      122       -1     
  Lines        7672     7491     -181     
==========================================
- Hits         3547     3538       -9     
+ Misses       3807     3631     -176     
- Partials      318      322       +4     

Flag	Coverage Δ
unittests	47.23% <0.00%> (+0.99%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.