[FIX] Move substitute files into a tmpl folder

Cleans up `envsubst` command and allows command to be re-run

cluster/core/infrastructure/cert-manager/secret.enc.yaml

@@ -1,8 +0,0 @@
-# yamllint disable
-apiVersion: v1
-kind: Secret
-metadata:
-    name: cloudflare-token-secret
-    namespace: cert-manager
-stringData:
-    cloudflare-token: ${BOOTSTRAP_CLOUDFLARE_TOKEN}