[patch] Update CLI issuerKind derivation for MAS 9.3+

[praiyani6789]

Description

In MAS 9.2, issuerKind controlled both internal and external certificate issuance, so the CLI had to prompt users for it and enforce that ClusterIssuer could only be used with --admin-mode cluster. In MAS 9.3+, the internal issuer is always Issuer (namespace-scoped, operator-managed), so issuerKind now only controls the external/public issuer — making it something the CLI can derive automatically from the user's DNS provider and routing choices rather than prompting for it explicitly.

This PR version-gates all issuerKind logic on 9.3.0. On 9.3+, --mas-issuer-kind is no longer accepted as a CLI flag (a fatal error is raised if passed), and issuerKind is derived automatically: ClusterIssuer when a DNS provider (Cloudflare, CIS, Route53) is configured, Issuer when Let's Encrypt HTTP-01 is chosen in path mode or when no DNS provider is set. The old validation that blocked ClusterIssuer in namespaced/minimal modes is removed for 9.3+ since the internal issuer is no longer affected by this field. The DNS integration restriction in namespaced/minimal modes is also scoped to 9.2 only — on 9.3+ customers can use a ClusterIssuer for external certs regardless of admin mode. On 9.2, all existing validation and prompt behaviour is preserved unchanged.

Related Issues

• MASCORE-18195
• tdd

Testing

These changes are for MAS 9.3+ versions.
Install MAS without DNS integration (default domain) then it will use Issuer automatically:

Install MAS with DNS integration (custom domain) then it will use ClusterIssuer automatically:

Install MAS with Let's encrypt enabled for path routing mode then it will use Issuer automatically

If by mistake someone passes the --mas-issue-kind flag to the CLI for a MAS 9.3 install:

[IanBoden]

This seems like something we should be able to add unit tests for