feat: Support configuring the name of the ca.crt in the TrustStore

[sbernauer]

Description

Requested in https://stackable-workspace.slack.com/archives/C08GM6S8Z8D/p1770893067445359.

We already added a field to write to either a ConfigMap or Secret, in the hope that OpenShift can read the Secret.
Unfortunately one detail seems to be different: Openshift expects the CA in a Secret with the CA PEM in key tls.crt but the TrustStore provides it as ca.crt.
This PR simply adds a field on the TrustStore CRD where users can configure the name.

For the actual CRD change see extra/crds.yaml, the current state is

--- a/extra/crds.yaml
+++ b/extra/crds.yaml
@@ -920,6 +920,14 @@ spec:
                 - Secret
                 - ConfigMap
                 type: string
+              tlsPemCaName:
+                default: ca.crt
+                description: |-
+                  Name of the key in the ConfigMap/Secret, in which the PEM encoded CA certificate should be placed.
+
+                  Only takes effect in case the `format` is `tls-pem`.
+                  Defaults to `ca.crt`.
+                type: string
             required:
             - secretClassName
             type: object

Definition of Done Checklist

• Not all of these items are applicable to all PRs, the author should update this template to only leave the boxes in that are relevant
• Please make sure all these things are done and tick the boxes

Author

• Changes are OpenShift compatible
• CRD changes approved
• CRD documentation for all fields, following the style guide.
• Helm chart can be installed and deployed operator works
• Integration tests passed (for non trivial changes)
• Changes need to be "offline" compatible
• Links to generated (nightly) docs added
• Release note snippet added

Reviewer

• Code contains useful comments
• Code contains useful logging statements
• (Integration-)Test cases added
• Documentation added or updated. Follows the style guide.
• Changelog updated
• Cargo.toml only contains references to git tags (not specific commits or branches)

Acceptance

• Feature Tracker has been updated
• Proper release label has been added
• Links to generated (nightly) docs added
• Release note snippet added
• Add type/deprecation label & add to the deprecation schedule
• Add type/experimental label & add to the experimental features tracker

[razvan]

Edit I meant this
This is fresh in my mind since I'm working on related stuff for spark : op-rs need to be updated too in order to be aware of this otherwise things will break.

[sbernauer]

You are talking about how the ca.crt is called "on disk" in the secret-op volume. This PR does not affect that in any way, this is only about the TrustStore CustomResource, which you can use to request that a ConfigMap or Secret with the trust information is placed in your namespace. These CM/Secrets are only used by the user, no Stackable Pods.

[razvan]

I see. Thanks.