Automated Manifest Update (#5173)

This PR contains newly rendered Kubernetes manifests automatically generated by the CI workflow.

### Details
- **Trigger**: `pull_request` by `@alexlebens`
- **Commit**: `c3e134f` (on `c3e134ffba591e2752db6fe0a1721ea0de524b87`)
- **Charts Updated**: `eraser,excalidraw,external-dns,external-secrets`

### Update Details (2026-03-27 00:30 UTC)
- **Trigger**: `pull_request` by `@alexlebens`
- **Commit**: `f09911d` (on `f09911d84f8bf423991c1d2d52318926b66eef76`)
- **Charts Updated**: `external-dns`

Reviewed-on: #5173
Co-authored-by: gitea-bot <gitea-bot@alexlebens.net>
Co-committed-by: gitea-bot <gitea-bot@alexlebens.net>

clusters/cl01tl/manifests/external-secrets/Deployment-external-secrets-cert-controller.yaml

@@ -40,7 +40,7 @@ spec:
             runAsUser: 1000
             seccompProfile:
               type: RuntimeDefault
-          image: ghcr.io/external-secrets/external-secrets:v2.2.0
+          image: ghcr.io/external-secrets/external-secrets:v2.2.0@sha256:876e627dbee5b0edd12da49b035469d12418cd6c3c4be5e383ae6a82e8bd4565
           imagePullPolicy: IfNotPresent
           args:
             - certcontroller
@@ -54,6 +54,7 @@ spec:
             - --loglevel=info
             - --zap-time-encoding=epoch
             - --enable-partial-cache=true
+            - --enable-leader-election=true
           ports:
             - containerPort: 8080
               protocol: TCP
@@ -67,3 +68,7 @@ spec:
               path: /readyz
             initialDelaySeconds: 20
             periodSeconds: 5
+          resources:
+            requests:
+              cpu: 1m
+              memory: 60Mi