Support cert-manager certs for custom CA

**Describe the problem/challenge you have**
As a user of kapp-controller, I have cert-manager installed and configured with a custom CA stored in a secret and then I have a ClsuterIssuer to generate our own certificates:

```
apiVersion: v1
kind: Secret
metadata:
name: local-root-ca
namespace: cert-manager
data:
tls.crt: #@ base64.encode(data.values.local.root_ca.crt)
tls.key: #@ base64.encode(data.values.local.root_ca.key)
---
apiVersion: cert-manager.io/v1alpha2
kind: ClusterIssuer
metadata:
name: wildcard
spec:
ca:
secretName: local-root-ca
```

I would want to be able to easily configure kapp-controller with a reference to my secret and not require to provide the raw cert again in kapp-controller's ConfigMap as documented here: https://github.com/vmware-tanzu/carvel.dev/blob/develop/content/kapp-controller/docs/latest/controller-config.md

**Describe the solution you'd like**
I would want to have something like this in the ConfigMap, or some other simpler way to configure kapp:

```
apiVersion: v1
kind: ConfigMap
metadata:
name: kapp-controller-config
namespace: kapp-controller
data:
ca:
secretName: local-root-ca
```

Since this is using a ConfigMap it would be difficult to do as it is, but some elegant solution would be ideal.

---
Vote on this request

This is an invitation to the community to vote on issues, to help us prioritize our backlog. Use the "smiley face" up to the right of this comment to vote.

👍 "I would like to see this addressed as soon as possible"
👎 "There are other more important things to focus on right now"

We are also happy to receive and review Pull Requests if you want to help to work on this issue.