Add cnameStrategy: Follow to ACME DNS-01 solvers

A live smoke test showed cert-manager sending the rfc2136 UPDATE to zone
unkin.net (walked from _acme-challenge.unkin.net), which bind-external is
not authoritative for, returning NOTAUTH; the solver was not following the
delegation CNAME.

- Set cnameStrategy: Follow on the letsencrypt and letsencrypt-staging
  ClusterIssuer DNS-01 solvers so cert-manager chases the
  _acme-challenge.unkin.net -> _acme-challenge.acme.unkin.net CNAME and
  updates the acme.unkin.net zone.

Claude-Session: https://claude.ai/code/session_01JUoARVdmhxKQHyyyp1pxeT

apps/base/cert-manager/clusterissuer_letsencrypt-staging.yaml

@@ -11,6 +11,7 @@ spec:
       name: letsencrypt-staging-account-key
     solvers:
       - dns01:
+          cnameStrategy: Follow
           rfc2136:
             nameserver: "198.18.199.53:53"
             tsigKeyName: certmanager

apps/base/cert-manager/clusterissuer_letsencrypt.yaml

@@ -11,6 +11,7 @@ spec:
       name: letsencrypt-account-key
     solvers:
       - dns01:
+          cnameStrategy: Follow
           rfc2136:
             nameserver: "198.18.199.53:53"
             tsigKeyName: certmanager