Terminate TLS on OpenBao with a cert-manager self-signed certificate

Adds a ClusterIssuer (selfSigned) + Certificate, mounts the resulting
secret into the OpenBao pod, and switches the listener config from
tls_disable=1 to a TLS-enabled listener. UI/API is now served over
https://<node-ip>:30200 instead of plain HTTP.

Also updates ClusterSecretStore/bootstrap Job to use https + trust the
self-signed cert via caProvider/BAO_SKIP_VERIFY.

Co-authored-by: Copilot <[email protected]>

templates/clustersecretstore.yaml

@@ -8,9 +8,16 @@ metadata:
 spec:
   provider:
     vault:
-      server: "http://{{ include "openbao-gitops.openbaoFullname" . }}.{{ .Release.Namespace }}.svc:8200"
+      server: "{{ if .Values.tls.enabled }}https{{ else }}http{{ end }}://{{ include "openbao-gitops.openbaoFullname" . }}.{{ .Release.Namespace }}.svc:8200"
       path: {{ .Values.eso.kvMountPath }}
       version: v2
+      {{- if .Values.tls.enabled }}
+      caProvider:
+        type: Secret
+        name: {{ .Values.tls.secretName }}
+        namespace: {{ .Release.Namespace }}
+        key: tls.crt
+      {{- end }}
       auth:
         kubernetes:
           mountPath: kubernetes