Move cert-manager issuer into local helm chart
Using kubernetes_manifest is problematic, as it requires the cluster to exist & be connected to during the plan stage. This won't work when you're bootstrapping a new cluster (eg: staging).
The upstream cert-manager chart lacks a way to bootstrap issuers, so make our own little hacky chart locally and install that.
While we're here, drop the staging letsencrypt issuer, it's unused.