This is related to
cert-manager#416. To use
IAM Roles Anywhere, we will have a client certificate managed by a
different cert-manager issuer. To reload the certificate when it is
renewed, we need to be able to set annotations on the deployment (to
make use of https://github.com/stakater/Reloader).

Validation:

```
$ helm template "foo" . --show-only templates/deployment.yaml  | head -n 20
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: foo-aws-privateca-issuer
  namespace: default
  labels:
    helm.sh/chart: aws-privateca-issuer-v1.6.0
    app.kubernetes.io/name: aws-privateca-issuer
    app.kubernetes.io/instance: foo
    app.kubernetes.io/version: "v1.6.0"
    app.kubernetes.io/managed-by: Helm
spec:
  replicas: 2
  strategy:
    type: RollingUpdate
    rollingUpdate:
      maxUnavailable: 1
  revisionHistoryLimit: 10
$ cat annotation.yaml
annotations:
  foo: bar
$ helm template "foo" . -f annotation.yaml --show-only templates/deployment.yaml  | head -n 20
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: foo-aws-privateca-issuer
  namespace: default
  labels:
    helm.sh/chart: aws-privateca-issuer-v1.6.0
    app.kubernetes.io/name: aws-privateca-issuer
    app.kubernetes.io/instance: foo
    app.kubernetes.io/version: "v1.6.0"
    app.kubernetes.io/managed-by: Helm
  annotations:
    foo: bar
spec:
  replicas: 2
  strategy:
    type: RollingUpdate
    rollingUpdate:
```

Signed-off-by: Adam Kafka <[email protected]>