Update remaining resource ingress.class behaviors

[rainest]

What this PR does / why we need it:

• Updates the last permissive legacy class matching logic (for Knative and CA certificate secrets) to their modern, exact match logic.
• Updates CA certificate tests to include class annotations.
• Use a reference to the default class exported by annotations rather than the literal "kong" string in tests.
• Explicitly sets global KongPlugin matching to ExactOrEmptyMatching.

Which issue this PR fixes
fixes #739
fixes #731

Special notes for your reviewer:
Changes for #731 are a composite of this and the implementation for #732, which was merged in #767. See comments in #731 for additional details.

We had originally discussed also rolling removal of the ListGlobalKongPlugins() store function into this, but on further review, we should leave that in. We list them only to report that they're there and instruct users to convert them to KongClusterPlugins:

kubernetes-ingress-controller/internal/ingress/controller/parser/parser.go

Lines 1593 to 1601 in de29e98

	globalPlugins, err := p.store.ListGlobalKongPlugins()
	if err != nil {
	return nil, fmt.Errorf("error listing global KongPlugins: %w", err)
	}
	if len(globalPlugins) > 0 {
	p.Logger.Warning("global KongPlugins found. These are no longer applied and",
	" must be replaced with KongClusterPlugins.",
	" Please run \"kubectl get kongplugin -l global=true --all-namespaces\" to list existing plugins")
	}

ListGlobalKongPlugins() is still a bit odd as it sorta still used the legacy matching behavior: it tracked the Ingress matching behavior, but that has since changed. Tracking it now would omit warnings for global KongPlugins with no class annotation (which were previously processed if you used the default "kong" class). As such, this PR preserves the function, but always uses ExactOrEmptyMatching to try and match the old behavior as best possible.

[hbagdi]

Thank you for arranging the commits the way you have. That allows for rebasing and merging in.

Please add test cases in each commit for the change you have done (doesn't apply to test commit, but others do need additional tests).