Persist cleared provisioning error before HTTP challenge

When DNS and CAA checks pass, ProvisioningError is set to nil but
was only persisted later alongside the challenge data. If
GetHTTPChallenge then failed, the update was never reached,
leaving stale DNS/CAA error messages visible to the user.

Signed-off-by: Bryan Frimin <bryan@getprobo.com>

pkg/certmanager/provisioner.go

@@ -369,6 +369,9 @@ func (p *Provisioner) provisionDomainCertificate(
 		}
 
 		domain.ProvisioningError = nil
+		if err := domain.Update(ctx, tx, coredata.NewNoScope()); err != nil {
+			return fmt.Errorf("cannot clear provisioning error: %w", err)
+		}
 
 		p.logger.InfoCtx(ctx, "DNS configuration verified, initiating HTTP challenge for domain", log.String("domain", domain.Domain))