reduce the number of certs and secrets labeled to just cs-ca and zen-…

[bluzarraga]

…ca plus already specified

What this PR does / why we need it:
Instead of labeling every secret and certificate watched by cert manager, we limit it to the "primary" resources that all other secrets are generated based on. These are the cs-ca-certificate and its accompanying secret and the zen-ca-cert-secret. In addition, there are other secrets previously specified in the script that are still labeled like the IM admin credentials since we do not want those to be regenerated with a different value.

Previously, it did not matter if we labeled them all but now that we need to support restoring into a different namespace, it is very difficult to create the logic that would individually update namespace related values (like dns lists) in secrets like the common-service-db-tls-cert. The secret values should be the same as on the original cluster because they are inherited from the cs-ca-certificate-secret so as long as that secret is carried over, the regenerated secret should contain the same values but with updated namespace values.

Which issue(s) this PR fixes:
Fixes #

Special notes for your reviewer:

1. How the test is done?
   Test BR as normal but using this script to label certs and secrets
   If resources fail to come up due to certificate issues after restore then we are missing certs/secrets.

I have tested this previously but it was a few weeks ago with a simple BR setup (one without zen or im) so it's possible this is not sufficient when including zen and im

How to backport this PR to other branch:

1. Add label to this PR with the target branch name backport <branch-name>
2. The PR will be automatically created in the target branch after merging this PR
3. If this PR is already merged, you can still add the label with the target branch name backport <branch-name> and leave a comment /backport to trigger the backport action

[ibm-ci-bot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: bluzarraga

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [bluzarraga]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment