Bump the test cert-manager to v1.21.3

cert-manager v1.20 can store two private keys for one new Certificate
when its cache lags behind. It then checks the request against the
wrong key, fails it with "CSR not signed by referenced private key",
and waits 1 hour before it tries again (cert-manager/cert-manager#6331).
The e2e setup waits about 5 minutes for trust-manager, so the job fails
with "Failed to install trust manager". This failed #4807, #4808, #4820
and #4828 between 2026-10-20 and 2026-10-27.

Since v1.21.0 the keymanager reads the Certificate and its key Secret
from the API server before it creates a key, so it does not make a
second one.

v1.21 also removes the cert-manager-tokenrequest Role and RoleBinding
and renames the metrics Service port to http-metrics. The tests use
neither.

Author: gauron99

hack/update-codegen.sh

@@ -94,4 +94,4 @@ cert_manager_installer="${REPO_ROOT_DIR}/vendor/knative.dev/eventing/hack/update
 # shellcheck source=/dev/null
 source <(grep -v '^update_cert_manager ' "${cert_manager_installer}")
 
-update_cert_manager "v1.20.3" "v0.24.0"
+update_cert_manager "v1.21.3" "v0.24.0"