feat(certificatemanager): restore #171, which merged into a branch instead of main

[naxty]

Restores #171, which is marked Merged but whose code is not on main.

What happened

#171 was stacked. It merged into its parent branch, not into main — GitHub
marks a stacked pull request merged as soon as its commits are reachable from
its base, and its base was a branch. #167, #168, #169 and #170 went the same
way, but they were recovered when #173 landed, because #173 descended from them.

Nothing descended from #171, so certificate manager is the one batch still
missing: main currently has a Merged badge and no code. pkg/resources/certificatemanager
does not exist on main, and neither do the three schemas or six fixtures.

What this is

That content, on top of current main, and nothing else — 13 files. No rebase of
the old branch, which is three commits behind and would have touched 88.

Type	Case	CRUD	Discovery
GCP::CertificateManager::CertificateMap	certmanager-certificate-map	7/7, Replace skipped	4/4
GCP::CertificateManager::DnsAuthorization	certmanager-dns-authorization	7/7, Replace skipped	4/4
GCP::CertificateManager::TrustConfig	certmanager-trust-config	7/7, Replace skipped	4/4

Verified locally against the same service account CI uses. CI will run exactly
these three cases.

Two things worth keeping

The role is roles/certificatemanager.owner, not .editor. The draft asked
for editor. Editor carries every .create permission and no .delete
permission at all — only deleteTagBinding. With it, Create through Update pass
and Destroy fails on a permission denial that reads exactly like a plugin bug.

A trust config cannot be empty. The fixture and the schema comment both said
a config with no stores "is valid and trusts nothing". The API rejects it. The
fixture pins one throwaway self-signed anchor, inline, holding no private key.
The blank line before its closing """ is load-bearing: Certificate Manager
appends a trailing newline to every pemCertificate it stores, whatever was
sent, so a PEM declared without one passes Create and then fails Verify,
Extract, Sync and Update against its own certificate. That bites any forma with
an inline PEM, so it is in the CHANGELOG.

Not covered

Replace — no -replace.pkl fixtures. Certificate and CertificateMapEntry
are not in this batch.