Add images with >21 days deployment lag to image-updater

This change adds 3 images with deployment lag exceeding 21 days to the
image-updater configuration, enabling automated digest updates.

Images added to image-updater (all >21 days lag):
- kube-webhook-certgen (310d lag): registry.k8s.io/ingress-nginx/kube-webhook-certgen

Images NOT added to image-updater (have alternative update mechanisms):
- route-monitor-operator (86d lag): Updated via route-monitor-operator/Makefile 'update-digests-in-config' target
- blackbox-exporter (659d lag): Updated via route-monitor-operator/Makefile 'update-digests-in-config' target
- aks-command-runtime (1725d lag): Already tracked as aksCommandRuntime
- velero-server (114d lag): Removed from image-updater in previous commit
- velero-plugin-azure (139d lag): Removed from image-updater in previous commit
- velero-hypershift-plugin (46d lag): Removed from image-updater in previous commit

Pull-through cache setup (dev-infrastructure/templates/global-acr.bicep):
Velero ACR cache rules remain in place from previous commit to address
image deletion/overwrite issues in the konveyor registry.

Images not added (already in image-updater or lag <21 days):
- fluent-bit (12d lag) - already tracked as arobit-forwarder
- mdsd (18d lag) - already tracked as arobit-mdsd
- prometheus* images (16-19d lag) - already tracked, below threshold
- kube-state-metrics (69d lag) - already tracked
- msi-acrpull (56d lag) - already tracked as acrPull
- provider-azure (71d lag) - already tracked as secretSyncProvider
- controller/secrets-store-sync (195d lag) - already tracked as secretSyncController
- mise (337d lag) - source registry unknown, needs investigation
- mise-1p-container-image (72d lag) - already has MCR artifact sync configured

Related to: #4082

Author: venkateshsredhat

tooling/image-updater/config.yaml

@@ -226,3 +226,13 @@ images:
     targets:
     - jsonPath: defaults.adminApi.image.digest
       filePath: ../../config/config.yaml
+  # Kube Webhook Certgen (Ingress NGINX)
+  kube-webhook-certgen:
+    source:
+      image: registry.k8s.io/ingress-nginx/kube-webhook-certgen
+      tagPattern: "^v\\d+\\.\\d+\\.\\d+$"
+    targets:
+    - jsonPath: defaults.svc.ingress.controller.admissionWebhook.patch.image.sha
+      filePath: ../../config/config.yaml
+    - jsonPath: defaults.mgmt.ingress.controller.admissionWebhook.patch.image.sha
+      filePath: ../../config/config.yaml