Only use zerossl in CI

This is a follow-up of #1059 (closed), which fixed the ZeroSSL clusterIssuer registration.

I realized that the co-existence of LE and zerossl clusterIssuer will lead to unwanted consequences: Whenever the (default) zerossl clusterIssuer is unavailable the LE clusterIssuer is used as fallback. So we end up with LE certs which we want to avoid.

So we need to find a way to disable/don't install the LE issuer.

To upload designs, you'll need to enable LFS and have an admin enable hashed storage. More information