cert-manager: scrape webhook + cainjector metrics (VMServiceScrape)

Follow-up to #239. cert-manager already exposes metrics services
(webhook :9402 metrics, cainjector :9402 http-metrics) but nothing
scraped them. Add a VMServiceScrape so the observability VMAgent collects
cert-manager metrics (cert issuance, controller sync, etc.).

apps/base/cert-manager/kustomization.yaml

@@ -7,3 +7,4 @@ resources:
   - serviceaccount.yaml
   - clusterrole.yaml
   - clusterrolebinding.yaml
+  - vmservicescrape.yaml

apps/base/cert-manager/vmservicescrape.yaml

@@ -0,0 +1,17 @@
+---
+# Scrape cert-manager webhook + cainjector metrics endpoints.
+# Picked up by the observability VMAgent (selectAllByDefault).
+apiVersion: operator.victoriametrics.com/v1beta1
+kind: VMServiceScrape
+metadata:
+  name: cert-manager
+  namespace: cert-manager
+spec:
+  selector:
+    matchLabels:
+      app.kubernetes.io/instance: cert-manager
+  endpoints:
+    - port: metrics
+      path: /metrics
+    - port: http-metrics
+      path: /metrics