fix(gateways): add explicit group: "" to all certificateRefs entries (#153)

The Gateway API admission server defaults certificateRefs[].group to ""
when it is omitted. ArgoCD diffed the desired state (no group field) against
the live state (group: "") and flagged every gateway as out of sync.

Fix: explicitly set group: "" in all certificateRefs entries so the
rendered manifest matches the API server's canonical form exactly.

Affected: artifactapi, cattle-system, consul, litellm, paperclip,
puppet (puppetboard + puppetdb), vault.

Reviewed-on: #153

apps/base/puppet/gateway_puppetboard.yaml

@@ -35,6 +35,7 @@ spec:
       protocol: HTTPS
       tls:
         certificateRefs:
-          - kind: Secret
+          - group: ""
+            kind: Secret
             name: puppetboard-tls
         mode: Terminate

apps/base/puppet/gateway_puppetdb.yaml

@@ -28,6 +28,7 @@ spec:
       protocol: HTTPS
       tls:
         certificateRefs:
-          - kind: Secret
+          - group: ""
+            kind: Secret
             name: puppetdb-tls
         mode: Terminate