feat(db): enable JDBC TLS configuration

[andrewazores]

Welcome to Cryostat! 👋

Before contributing, make sure you have:

• Read the contributing guidelines
• Linked a relevant issue which this PR resolves
• Linked any other relevant issues, PR's, or documentation, if any
• Resolved all conflicts, if any
• Rebased your branch PR on top of the latest upstream main branch
• Attached at least one of the following labels to the PR: [chore, ci, docs, feat, fix, test]
• Signed all commits: git commit -S -m "YOUR_COMMIT_MESSAGE"

---

Related to #1005

Description of the change:

Enables JDBC TLS configuration for the connection between Cryostat and the database container. This sets up TLS on the database's server side, and sets up Cryostat's database driver to expect to find a TLS port there and to require that the connection passes all checks (cert from trusted CA, hostname matches, SSL/TLS must be enabled). Authentication from the client (Cryostat) to the database server is still using normal Basic-style authentication, not TLS client certificate authentication.

If TLS is disabled, ie cert-manager is not available, then this should fall back to the same previous unencrypted JDBC behaviour.

Motivation for the change:

Enhances security.

How to manually test:

1. Check out and build PR
2. Install cert-manager
3. Deploy Operator
4. Create Cryostat CR
5. Everything should continue to work as expected. Verify that the Cryostat container's environment variables specify the JDBC URL with SSL parameters: jdbc:postgresql://cryostat-sample-database.cryostat.svc.cluster.local:5432/cryostat?ssl=true&sslmode=verify-full&sslcert=&sslrootcert=/var/run/secrets/operator.cryostat.io/cryostat-sample-database-tls/ca.crt. In particular ssl=true and sslmode=verify-full should be present, and the sslrootcert= should point to the database TLS secret and the ca.crt corresponding to the cert used by the database container.
6. Edit Cryostat CR and set .spec.enableCertManager: false. After everything gets redeployed, ensure it's all still working, but now the JDBC URL has no SSL parameters, the database container has no SSL arguments, etc.

[andrewazores]

/build_test

[andrewazores]

https://github.com/cryostatio/cryostat-operator/actions/runs/12836146364

[github-actions]

/build_test completed successfully ✅.
View Actions Run.