certmanager: enable ServiceMonitor to allow for user alerts on expiring certificates

See https://gitlab.cern.ch/kubernetes/automation/releases/kops/-/merge_requests/606 for details.

We will likely need to update cluster-config to allow for this to be optionally enabled when monitoring is enabled.