fix(ngf): HTTP-01/ListenerSet cert flow, wildcard TLS, CP bumps + Gateway API v1.5.1

- Mirror #554: control-plane resource bumps + Gateway API CRDs v1.5.1.
- HTTP-01 + ListenerSet cert issuance; remove the ACK ACM controller + DNS-01 path
  (drop the ack_acm_controller output).
- cert_manager: enable --enable-gateway-api-listenerset, enableCertificateOwnerRef, tls
  provider in facets_default_providers; bundle cert-manager v1.20.3.
- gateway_api_crd: grant installer RBAC for ValidatingAdmissionPolicy.
- aws/azure/gcp/ovh flavors: private/internal LB support + DNS-01 (gts-production) cert
  issuance + wildcard TLS; declare dns01_cluster_issuer/cluster_issuer_override in the
  instance spec type; track the base module default branch.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: sanmesh-kakade