Fixes: #130

Fixes: #132

Update the semgrep workflow to always use the "ubuntu-latest" release.

The configuration added by the AppSec team did not take the default
branch into account.

Updating semgrep docker image for the exising semgrep workflow.

The integration suite was guarded behind the "suite" build tag, which
prevented Go tooling from working with the integration tests by default.
This made the upcoming refactoring to support API tokens more difficult,
and has historically discouraged the addition of more integration tests.

As modern versions of Go support `testing.Cleanup` we can move the
envtest setup into a helper function that runs, and automatically cleans
up, in every test, instead of wrapping the main function. The tests are
guarded by checking for the presence of the KUBEBUILDER_ASSETS
environment variable, which is set by `setup-env` in the CI environment.

Replace an interface with a Builder type that can be partially
constructed before being passed to the CertificateRequest controller.

This changeset also adjusts the CertificateRequest controller's tests to
use go-vcr to better test the (un)marshalling of requests and responses.

Prepare to allow multiple authentication types by allowing ServiceKeyRef
to become nil, and requiring the controllers to properly handle no
authentication types being set.

Bug: #135

Adds support for using API Tokens to authenticate with the Cloudflare
API, in addition to the existing support for Origin CA Service Keys.

Bug: #135

Documents support for using scoped API Tokens alongside the existing
support for Origin CA service keys.

Bug: #135

To be moved to the "production ready" tier in upstream's documentation,
we need to include the versions of Kubernetes and cert-manager
supported, and link to upstream's installation docs.