docs: insert cert-manager after namespaces in expose a service

The progression of namespaces, cert-manager, then gateway api and istio
makes much more sense than the previous progression of gateway api,
namespaces, istio.

cert-manager builds nicely on top of namespaces.  gateway api are only
crds necessary for istio.

This patch also adds the local-ca component which surfaces issue #237
The Kubernetes APIObjects are unnecessarily constrained to resources we
define in the schema.  We need to move the marshal code into package
holos so the user can add their own resource kinds.

.cspell.json

@@ -17,8 +17,11 @@
     "buildplan",
     "cainjector",
     "CAROOT",
+    "certificaterequests",
+    "certificatesigningrequests",
     "clsx",
     "clusterissuer",
+    "clusterissuers",
     "clusterrole",
     "clusterrolebinding",
     "configmap",
@@ -71,6 +74,7 @@
     "Kustomizations",
     "kustomize",
     "ldflags",
+    "leaderelection",
     "libnss",
     "loadbalancer",
     "mattn",
@@ -117,6 +121,7 @@
     "startupapicheck",
     "stefanprodan",
     "structpb",
+    "subjectaccessreviews",
     "svclb",
     "systemconnect",
     "tablewriter",