Terminate TLS on OpenBao with a cert-manager self-signed certificate

Adds a ClusterIssuer (selfSigned) + Certificate, mounts the resulting
secret into the OpenBao pod, and switches the listener config from
tls_disable=1 to a TLS-enabled listener. UI/API is now served over
https://<node-ip>:30200 instead of plain HTTP.

Also updates ClusterSecretStore/bootstrap Job to use https + trust the
self-signed cert via caProvider/BAO_SKIP_VERIFY.

Co-authored-by: Copilot <[email protected]>

templates/bootstrap-job.yaml

@@ -29,7 +29,11 @@ spec:
           image: {{ .Values.bootstrap.image }}
           env:
             - name: BAO_ADDR
-              value: "http://{{ include "openbao-gitops.openbaoFullname" . }}:8200"
+              value: "{{ if .Values.tls.enabled }}https{{ else }}http{{ end }}://{{ include "openbao-gitops.openbaoFullname" . }}:8200"
+            {{- if .Values.tls.enabled }}
+            - name: BAO_SKIP_VERIFY
+              value: "true"
+            {{- end }}
             - name: BAO_TOKEN
               valueFrom:
                 secretKeyRef: