Self-manage cert-manager on management clusters

**What would you like to be added**:
This request is specific to **management clusters**. We would like to instruct EKS-Anywhere to either:
- customize `deployment.apps/cert-manager` (i.e. specifically `.spec.containers.args[*]`).
- or skip managing `cert-manager` altogether past the initial bootstrap.
- Like `cniConfig.cilium.skipUpgrade` allows for a [custom CNI](https://anywhere.eks.amazonaws.com/docs/getting-started/optional/cni/#use-a-custom-cni).

**Why is this needed**:
We rely on `cert-manager` to issue certificates signed by a public Certification Authority for private endpoints, and therefore need to configure `cert-manager` with `--dns01-recursive-nameservers-only` to get around the split horizon for DNS01 challenge record verification.

Currently, if following the initial `eksctl anywhere create cluster`:
1. We manually remove `cert-manager` components (but the CRDs, so existing `certificates.cert-manager.io` objects remain).
2. Then recreate them through our custom `cert-manager` deployment in a different namespace.
3. Subsequent `eksctl anywhere upgrade cluster` fail with `Error: failed to upgrade cluster: waiting for workload cluster capi components to be ready: waiting for cert-manager in namespace cert-manager: executing wait: executing wait: Error from server (NotFound): namespaces "cert-manager" not found`

Start by tracing how `eksctl anywhere create cluster` installs and how `eksctl anywhere upgrade cluster` waits for the `cert-manager` deployment in the `cert-manager` namespace. Compare the requested deployment argument customization with the `cniConfig.cilium.skipUpgrade` behavior. Done means management clusters can retain a supported custom cert-manager configuration or skip its later management without upgrade failures.

Written by the indexing model from the issue text.