Add TLS support for multiple service endpoints

[Deydra71]

Some services create multiple endpoints, therefore each endpoint needs to support TLS.

[stuggi]

@Deydra71 @olliewalsh wondering if this would be a more generic definition of the certs we need, also with the possibility to customize the mount paths. this might be useful for the edpm side where default cert location for libvirt/qemu is /etc/pki/libvirt/ , /etc/pki/libvirt/private/, but could also use the config params cert_file key_file for this. https://wiki.libvirt.org/TLSCreateServerCerts.html#overriding-the-default-locations

// Service contains server-specific TLS secret
type Service struct {
	// +kubebuilder:validation:Optional
	// SecretName - holding the cert, key for the service
	SecretName string `json:"secretName,omitempty"`
	// +kubebuilder:validation:Optional
	// CertMount - dst location to mount the service tls.crt cert. Can be used to override the default location which is /etc/tls/<service key>/tls.crt
	CertMount *string `json:"certMount,omitempty"`
	// +kubebuilder:validation:Optional
	// KeyMount - dst location to mount the service tls.key  key. Can be used to override the default location which is /etc/tls/<service key>/tls.key
	KeyMount *string `json:"keyMount,omitempty"`
	// +kubebuilder:validation:Optional
	// CaMount - dst location to mount this cert CA ca.crt cert to. Can be used if the service CA cert should be mounted specifically, e.g. to be set in a service config for validation, instead of the env wide bundle.
	CaMount *string `json:"caMount,omitempty"`
	// +kubebuilder:validation:Optional
	// DisableNonTLSListeners - disable non TLS listeners of the service (if supported)
	DisableNonTLSListeners bool `json:"disableNonTLSListeners,omitempty"`
}

// Ca contains CA-specific settings, which could be used both by services (to define their own CA certificates)
// and by clients (to verify the server's certificate)
type Ca struct {
	// +kubebuilder:validation:Optional
	// CaBundleSecretName - dst location to mount the CA cert bundle
	CaBundleSecretName string `json:"caBundleSecretName,omitempty"`

	// +kubebuilder:validation:Optional
	// +kubebuilder:default="/etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem"
	// CaBundleMount - dst location to mount the CA cert bundle
	CaBundleMount *string `json:"caBundleMount,omitempty"`
}

// TLS - a generic type, which encapsulates both the service and CA configurations
type TLS struct {
	// certificate configuration for API service certs
	APIService map[service.Endpoint]Service `json:"APIService"`
	// certificate configuration for additional arbitrary certs
	Service map[string]Service `json:"service"`
	// CA bundle configuration
	Ca      *Ca      `json:"ca"`
}

[Deydra71]

I've implemented the changes to the structs and their fields as suggested by @stuggi ^^ Following these updates the functions and tests were revised within the tls package, so it should now be in place for operator testing.

[Deydra71]

With changes TLS support is moved here ---> #428