convert: add support for genCA function

[myitcv]

Is your feature request related to a problem? Please describe.

The nginx chart's ingress-tls-secret.yaml and tls-secret.yaml
templates are skipped because they use the genCA function:

unsupported template action: {{$ca := genCA "nginx-ca" 365}}

This affects 2 templates in the nginx-22.0.7 integration test.

Describe the solution you'd like

Add support for genCA and related crypto certificate functions
(genSelfSignedCert, genSignedCert, etc.) from the Sprig
library. These generate certificates at render time, so the CUE
output would need to represent them as placeholder values or
runtime dependencies.