docs: document certgen command

[AkashKumar7902]

Fixes #2183

What this PR does

• documents every contour certgen output mode, Secret format, flag, and positional argument in the existing Contour configuration reference
• adds examples, overwrite and certificate-rotation guidance, generated file permissions, and the current kubeconfig requirement
• links the gRPC TLS guide to the command reference and aligns its local command with the compact Secret format used by the shipped Job
• makes the Job-based rotation steps work with the installed, version-dependent Job name

Why

The documentation mentioned contour certgen and used it in the deployment Job, but did not provide a command-line reference. Users had to inspect the implementation to understand its outputs, accepted Secret layouts, defaults, or overwrite behavior.

User impact

Operators can choose the correct output and Secret format, understand what each invocation replaces, and generate xDS TLS material using documented commands.

Release note

Requested label: release-note/docs. The corresponding docs changelog is included.

Testing

• git diff --check
• make lint-codespell
• go test ./cmd/contour ./internal/certgen ./pkg/certs
• hugo --gc --minify with the Netlify-pinned Hugo 0.152.0
• disposable certgen smoke tests for PEM, compact Secret, and legacy Secret output

[github-actions]

The Contour project currently lacks enough contributors to adequately respond to all PRs.

This bot triages PRs according to the following rules:

• After 30d of inactivity, lifecycle/stale is applied
• After 60d of inactivity since lifecycle/stale was applied, the PR is closed

You can:

• Ensure your PR is passing all CI checks. PRs that are fully green are more likely to be reviewed. If you are having trouble with CI checks, reach out to the #contour channel in the Kubernetes Slack workspace.
• Mark this PR as fresh by commenting or pushing a commit
• Close this PR
• Offer to help out with triage

Please send feedback to the #contour channel in the Kubernetes Slack