cert-manager keeps old keystore password until certificate re-issuance

Testing of cert-manager v1.21.2 found that after changing the keystore password in the referenced Secret or inline field, keystore.jks and keystore.p12 in the target Secret stay encrypted with the old password until the certificate is re-issued. The Certificate stayed Ready=True throughout the 30-minute observation window, despite API docs promising immediate update.

• Tested on cert-manager v1.21.2 in a single-node kind cluster
• Old password still worked for the full 30-minute window
• Certificate remained Ready=True with the stale password
• Manual cmctl renew re-issuance switched keystores to the new password