namespace-wildcard-cert-selector with empty object does not work

/area networking
/kind spec

## What version of Knative?

knative-serving v1.2.5

## Expected Behavior
the doc for config-networking states:

```yaml
# namespace-wildcard-cert-selector specifies a LabelSelector which
# determines which namespaces should have a wildcard certificate
# provisioned.
#
# Use an empty value to disable the feature (this is the default):
# namespace-wildcard-cert-selector: ""
#
# Use an empty object to enable for all namespaces
# namespace-wildcard-cert-selector: {}
#
# Useful labels include the "kubernetes.io/metadata.name" label to
# avoid provisioning a certifcate for the "kube-system" namespaces.
# Use the following selector to match pre-1.0 behavior of using
# "networking.knative.dev/disableWildcardCert" to exclude namespaces:
#
# matchExpressions:
# - key: "networking.knative.dev/disableWildcardCert"
# operator: "NotIn"
# values: ["true"]
namespace-wildcard-cert-selector: ""
```

especally:
```
Use an empty object to enable for all namespaces
# namespace-wildcard-cert-selector: {}
```

## Actual Behavior

when using an empty object as suggested, I get a validation error:
```
# configmaps "config-network" was not valid:
# * : Invalid value: "The edited file failed validation": ValidationError(ConfigMap.data.namespace-wildcard-cert-selector): invalid type for io.k8s.api.core.v1.ConfigMap.data: got "map", expected "string"
```
I'm trying to use a specific label but it doesn't seem to work, however it is not clear what object is being looked up therefore it is not clear what label should be used.

## Steps to Reproduce the Problem

Edit the config-network and set
`namespace-wildcard-cert-selector` to {}

Ideally I want to allow this for all namespaces, but this setting doesn't work.

Start by reproducing the validation error in the config-network ConfigMap using the documented namespace-wildcard-cert-selector examples. Trace how config-networking parses and validates the selector, including a label-based selector, and verify the intended all-namespaces behavior. Done means the supported configuration is accepted and the documentation clearly explains the required value and label scope.

Written by the indexing model from the issue text.