Fix CAA issuer matching to handle parameters

CAA issue records may contain parameters after a semicolon per
RFC 8659 (e.g. "letsencrypt.org; accounturi=..."). Split on ";"
and compare only the issuer domain so these records are accepted.

Signed-off-by: Bryan Frimin <bryan@getprobo.com>

pkg/certmanager/provisioner.go

@@ -171,8 +171,11 @@ func (p *Provisioner) checkCAARecords(domain string) error {
 	}
 
 	for _, caa := range caaRecords {
-		if caa.Tag == "issue" && strings.EqualFold(caa.Value, p.caaIssuerDomain) {
-			return nil
+		if caa.Tag == "issue" {
+			issuer, _, _ := strings.Cut(caa.Value, ";")
+			if strings.EqualFold(strings.TrimSpace(issuer), p.caaIssuerDomain) {
+				return nil
+			}
 		}
 	}