Provide an Ingress snippet to serve cert.pem

Users should seal their secrets with the latest available certificate. But how do they know which that is?

There are a few problems:

1. The certificate has to be _authenticated_, i.e. users should be able to verify that the certificate is the one they're supposed to use, as opposed to something Mallory tricks them to use.

2. Every month or so a new certificate gets created.

Sealed secrets can operate roughly in two modes:

a. online: grab the latest certificate by connecting to the target cluster (e.g. if you can `kubectl proxy`, you can use the online method)
b. offline: pass a certificate file/url via `--cert`.

The _online_ method is a low friction operational mode of sealed-secrets, but the _offline_ mode is what enables some advanced use cases that are quite peculiar to sealed-secrets. It allows users to operate clusters even if they cannot touch them (e.g. pure GitOps without even having to get in the VPN etc).

We don't mandate how people use the _offline_ mode, but that doesn't mean we cannot make it a bit easier to setup a reasonable distribution channel for the public key:

Expose controller's `/v1/cert.pem` internal http endpoint via an Ingress, possibly authenticated with a TLS certificate (e.g. letsencrypt).

We probably cannot just include said Ingress resource in the main `controller.yaml`, because setting up an ingress requires some user choices, such as picking a domain name, picking the right annotations to choose the desired loadbalancer (internal, external etc) and least not least, the right kind of TLS certificate.

Hence, we should include a new "pubkey-ingress.yaml" file, that users can optionally apply (possibly overriding the missing bits manually or with kustomize).

Or perhaps a full `controller-with-ingress.yaml`?

Start by locating controller.yaml and the controller's /v1/cert.pem endpoint. Define the optional pubkey-ingress.yaml or controller-with-ingress.yaml approach, accounting for the domain, ingress annotations, and TLS choices users must customize; done means the manifest exposes the endpoint and can be adapted for those choices.

Written by the indexing model from the issue text.