WIP: Proposed API changes for ClusterBundle migration

[erikgb]

After getting feedback on the migration proposal, I believe the proposed (one-way) migration from Bundle to ClusterBundle could represent an opportunity to improve the API of trust-manager. So I did a little experiment and drafted some of the changes I think make sense. Relates to #485.

• The proposed changes to the API will address Don't sync targets to all namespaces by default #39 (simple).
• Changes will also make the target(s) specification a lot more consistent IMO, and address More flexible and better organized target specification in API #243. The proposed target spec will remove the need for many complex and error-prone webhook validations by making the api-server validate more.
• With this changed target structure, it will also be easier to replace even more webhook validations with CEL. I have an open PR suggesting exactly this, WIP: Replace webhook validations with CEL validation #475. Some of the CEL expressions are now rather complex but will become a lot simpler after this change.
• In addition, it will make testing simpler, and require less code to test (since we are using standard Kubernetes validations).
• Last but not least, the new API will also provides a new feature: the ability to get multiple keys of the same trust-bundle format in a target.

Since the proposed migration represents a one-way "conversion", I believe the conversion logic will be quite simple, as opposed to a round-trippable conversion webhook.

[cert-manager-prow]

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

[cert-manager-prow]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please ask for approval from erikgb. For more information see the Kubernetes Code Review Process.

The full list of commands accepted by this bot can be found here.

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment