[FEATURE] Add support for global LLM TLS CA configuration

[inFocus7]

📋 Prerequisites

• I have searched the existing issues to avoid creating a duplicate
• By submitting this issue, you agree to follow our Code of Conduct

📝 Feature Summary

Add support to configure a global LLM CA to simplify setup for provider communication

❓ Problem Statement / Motivation

We currently configure TLS CA certs on ModelConfigs. We should expand upon this to allow users to configure it on a global scale, this way we can avoid having to set the CA settings on a per-ModelConfig if the LLM only uses a single CA.

💡 Proposed Solution

no api/crd proposal yet, unsure where this configuration should live, worth discussing in the kagent dev meeting every other week.

🔄 Alternatives Considered

No response

🎯 Affected Service(s)

None

📚 Additional Context

• TLS CA support on ModelConfigs was added feat: Add SSL/TLS Configuration Support to ModelConfig CRD #1059
• There is ongoing work to auto-restart agents when a secret updates Automatic agent redeployment when TLS secret changes #1091. When supporting global CA, we should take the agent restart requirement into account.

🙋 Are you willing to contribute?

• I am willing to submit a PR for this feature