apisix-ingress-controller: webhook configuration supports no annotations, blocking cert-manager cainjector

The `ValidatingWebhookConfiguration` in the apisix-ingress-controller chart renders with no annotations and no way to add any. With `webhook.certificate.provided=true`, operators supplying the serving certificate from a cert-manager `Certificate` must hand-copy the CA into `webhook.certificate.caBundle` — and re-copy it whenever the CA rotates, or the API server silently stops trusting the webhook (with the default `failurePolicy: Ignore`, admission validation is skipped without any visible failure).

The ecosystem-standard fix is cert-manager's cainjector: annotate the webhook configuration with `cert-manager.io/inject-ca-from: /` and the caBundle is maintained automatically, rotation included. That needs only an annotations knob on the webhook template.

Proposed fix in #1004 — adds `webhook.annotations` (default `{}`); unset output is byte-identical to today.

Start by locating the apisix-ingress-controller chart template that renders the ValidatingWebhookConfiguration and the values for webhook.certificate. Render the chart with webhook.annotations unset and with cert-manager.io/inject-ca-from configured; done means the default output remains byte-identical and configured annotations appear on the webhook.

Written by the indexing model from the issue text.