certmanager: Drop embedded Mozilla TLSRef data in favour of util.tlsref This adds a 'tls_profile_version' configuration option. If unspecified, it will use the default profile version from util.tlsref. If specified, it must be either a valid version (known to util.tlsref) or the value "latest". This allows admins to pin to specific versions, go with the default (for the best balance between security/stability) or always use the latest available profiles.