fix: deduplicate ACM ARNs in NLB ssl-cert annotation

Use distinct() to avoid duplicate ARNs when multiple domains share
the same ACM wildcard certificate.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: sanmesh-kakade

modules/ingress/nginx_gateway_fabric_legacy_aws/1.0/main.tf

@@ -28,9 +28,9 @@ locals {
   acm_mode = !local.use_ack_acm && length(local.acm_cert_domains) > 0
 
   # ACM ARNs to attach to NLB for TLS termination
-  acm_cert_arns = local.acm_mode ? [
+  acm_cert_arns = local.acm_mode ? distinct([
     for domain_key, domain in local.acm_cert_domains : domain.certificate_reference
-  ] : []
+  ]) : []
 
   # K8s secret name for ACM cert domains — the ACK Certificate CRD exports cert to this secret
   # Only relevant when ACK controller is available