This is a followup issue to the initial tp1 cert-manager docs that should be done after tp2 code has been released since tp2 has some minor bug fixes that will simplify the cert-manager docs.

Changes:

1. Specifying `ROOT_CA_DIR` is no longer required since the downstream pilot image sets the working dir correctly in tp2.
2. The "latest" revision can be gotten from the istio resource itself.