Fix CAA issuer matching to handle parameters

CAA issue records may contain parameters after a semicolon per
RFC 8659 (e.g. "letsencrypt.org; accounturi=..."). Split on ";"
and compare only the issuer domain so these records are accepted.

Signed-off-by: Bryan Frimin <bryan@getprobo.com>

pkg/certmanager/provisioner.go

@@ -171,10 +171,13 @@ func (p *Provisioner) checkCAARecords(domain string) error {
 	}
 
 	for _, caa := range caaRecords {
-		if caa.Tag == "issue" && strings.EqualFold(caa.Value, p.caaIssuerDomain) {
+		if caa.Tag == "issue" {
+			issuer, _, _ := strings.Cut(caa.Value, ";")
+			if strings.EqualFold(strings.TrimSpace(issuer), p.caaIssuerDomain) {
 				return nil
 			}
 		}
+	}
 
 	return fmt.Errorf(
 		"caa records for domain %q do not permit issuance by %q",