[Bug] Cryostat certificate is signed by old CA after upgrade

[ebaron]

With 3.0, we change the name of the secret used for the Cryostat CA to avoid name collisions. This causes cert-manager to generate a new certificate when upgrading from 2.4 to 3.0. cert-manager does not detect that the CA has been changed and does not reissue Cryostat's certificate. This leads to not being able to connect to Cryostat using the Route, which does use the updated CA certificate.

To reproduce:

1. make deploy_bundle BUNDLE_IMG=quay.io/cryostat/cryostat-operator-bundle:2.4.0
2. oc create -f config/samples/operator_v1beta1_cryostat.yaml
3. Wait for ready
4. ./bin/operator-sdk run bundle-upgrade quay.io/cryostat/cryostat-operator-bundle:3.0.0-dev
5. Wait for ready
6. curl -k -sSI https://cryostat-sample-cryostat-test.apps.example.com

   HTTP/1.0 503 Service Unavailable
   pragma: no-cache
   cache-control: private, max-age=0, no-cache, no-store
   content-type: text/html
   

See: cert-manager/cert-manager#5851