Enable DNS challenges for Zerossl in addition to http

[clezag]

Currently SSL certificate creation is only handled via http challenges.

In old production we are using DNS challenges where possible (if we own the domain).
They are a bit more flexible e.g. you can create the certificate prior to switching DNS over to a new service and avoid any downtime while the https challenge would be fulfilled.

It should be sufficient to configure an additional Issuer and link it with route53, so applications can at a case by case basis decide on which issuer to use

See docs/helm#Certmanager as a starting point