Refresh Toolforge k8s certificates for prometheus and the admission controllers.

For previous work, see T308402. For automating the admission controller certificates, see T292238.

For the admission controller webhooks, rerun the get-cert.sh script similar to the doc, but do not bother the ca-bundle.sh script as that is no longer necessary at all except for local testing. That should inject the secret. To use the secret, delete the appropriate pods in the ingress-admission and registry-admission workspaces to restart them one at a time. Generally the README on the repos for these are the most authoritative docs if in doubt. This is automated now.

For the Prometheus ones, follow the doc on wikitech to recreate the certs.