docs(ngf): add clarification on listener certificateRefs

[pvillaverde]

Proposed changes

Add a clarification note to the cert-manager integration guide to clarify how multiple certificateRefs on an HTTPS Listener are handled based on nginx/nginx-gateway-fabric#5647

The current documentation may lead readers to expect that certificates are automatically selected based on the hostnames of attached HTTPRoute resources. In practice, certificateRefs are associated with the Listener, not individual routes. When different domains require different TLS certificates, separate HTTPS Listeners with distinct, non-overlapping hostname values are required.

This PR adds a short note to clarify this behavior and help users avoid hours of nightmare debugging trying to find what's wrong. I'm not sure if this is the best place to put it, but it's the one I would have found it when I checked the docs I think.

Checklist

Before sharing this pull request, I completed the following checklist:

• I read the Contributing guidelines
• My branch adheres to the Git conventions
• My content changes adhere to the F5 Technical Writing Style Guide
• If my changes involve potentially sensitive information¹, I have assessed the possible impact
• I have waited to ensure my changes pass tests, and addressed any discovered issues

Footnotes

1. Potentially sensitive information includes personally identify information (PII), authentication credentials, and live URLs. Refer to the style guide for guidance about placeholder content. ↩

[github-actions]

✅ All required contributors have signed the F5 CLA for this PR. Thank you!
_{Posted by the CLA Assistant Lite bot.}

[pvillaverde]

I have hereby read the F5 CLA and agree to its terms