Document ACME Challenge and Order RBAC restriction for v1.21

[wallrj-cyberark]

Preview:

• https://deploy-preview-2184--cert-manager.netlify.app/docs/releases/release-notes/release-notes-1.21/
• https://deploy-preview-2184--cert-manager.netlify.app/docs/releases/upgrading/upgrading-1.20-1.21/

Summary

• Add cert-manager-edit ClusterRole RBAC restriction note to release-notes-1.21.md, referencing security advisory GHSA-8rvj-mm4h-c258 (HIGH) and noting that this was already shipped in v1.20.3 and v1.19.6
• Add corresponding upgrade note to upgrading-1.20-1.21.md

Motivation

cert-manager/cert-manager#8958 merged the RBAC restriction into master. This documents the potentially breaking change for v1.21, matching the notes already written for the v1.20.3 patch release (#2174).

• Security advisory: GHSA-8rvj-mm4h-c258
• RBAC PR: Harden ACME Challenge and Order RBAC (GHSA-8rvj-mm4h-c258) cert-manager#8958
• v1.20.3 release notes PR: v1.20.3: patch release notes #2174

Test plan

• Netlify deploy preview renders correctly
• Release notes page shows GHSA-8rvj-mm4h-c258 advisory link and "Potentially breaking change" section
• Upgrade notes page (upgrading-1.20-1.21) shows RBAC restriction note
• Spellcheck passes

[cert-manager-prow]

@wallrj-cyberark: The label(s) area/website cannot be applied, because the repository doesn't have them.

Details

In response to this:

Summary

• Add release notes section documenting the removal of Challenge create and
  Order create/patch/update permissions from the cert-manager-edit
  aggregate ClusterRole (GHSA-8rvj-mm4h-c258).
• Add corresponding entry to the v1.20 → v1.21 upgrade guide.

Motivation

cert-manager/cert-manager#8958 merged the RBAC change into master. This is a
breaking change for any user or tooling that creates Challenge or Order
resources directly (not a supported workflow, but the permissions previously
existed in the aggregate ClusterRole).

Test plan

• Verified the Markdown renders correctly with the existing release notes and
  upgrade guide structure.

/area website

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[netlify]

✅ Deploy Preview for cert-manager ready!

Built without sensitive environment variables

Name	Link
🔨 Latest commit	a0cec0d
🔍 Latest deploy log	https://app.netlify.com/projects/cert-manager/deploys/6a42c9584ca1e600073553ff
😎 Deploy Preview	https://deploy-preview-2184--cert-manager.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

---

To edit notification comments on pull requests, go to your Netlify project configuration.

[wallrj]

/approve
/lgtm

[cert-manager-prow]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: wallrj

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [wallrj]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment