cluster: bindmount more cert paths

/etc/ssl/certs is currently mounted through in a number of places.
However, on Gentoo and CoreOS (and probably others), the files in
/etc/ssl/certs are just symlinks to files in /usr/share/ca-certificates.

For these components to correclty work, the target of the symlinks needs
to be available as well.

This is especially important for kube-controller-manager, where this
issue was noticed.

This change was originally part of #33965, but was split out for ease of
review.

cluster/saltbase/salt/kube-controller-manager/kube-controller-manager.manifest

@@ -134,6 +134,9 @@
         { "name": "etcssl",
         "mountPath": "/etc/ssl",
         "readOnly": true},
+        { "name": "usrsharecacerts",
+        "mountPath": "/usr/share/ca-certificates",
+        "readOnly": true},
         { "name": "varssl",
         "mountPath": "/var/ssl",
         "readOnly": true},
@@ -161,6 +164,10 @@
     "hostPath": {
         "path": "/etc/ssl"}
   },
+  { "name": "usrsharecacerts",
+    "hostPath": {
+        "path": "/usr/share/ca-certificates"}
+  },
   { "name": "varssl",
     "hostPath": {
         "path": "/var/ssl"}