* Do not allow pods in one namespace to create certificates for hostnames from another namespace.
* Make cluster domain configurable, clean up shouldMutate() logic, and make namespace restrictions configurable with restrictCertificatesToNamespace.
* Return certificate hostname validation errors in the admission webhook response.
* Appease the gometalinter.
