feat: Git sync - add first class support for CAs

[adwk67]

Description

Part of stackabletech/issues#820

Tested with Nifi changes:

--- PASS: kuttl (214.10s)
    --- PASS: kuttl/harness (0.01s)
        --- PASS: kuttl/harness/custom-components-git-sync_nifi-2.7.2_zookeeper-latest-3.9.4_openshift-false (211.59s)
PASS

...and Airflow changes:

--- PASS: kuttl (164.37s)
    --- PASS: kuttl/harness (0.00s)
        --- PASS: kuttl/harness/ca-cert_airflow-latest-3.1.6_openshift-false (163.61s)
PASS

CRD change

New optional field caCertSecretName containing a single field ca.crt.

Airflow:

    dagsGitSync:
      - repo: ...
        credentials:
          basicAuthSecretName: git-credentials
        gitFolder: "mount-dags-gitsync/dags_airflow3"
        wait: 5s
        caCertSecretName: git-ca-cert #     <-- Optional new field

Nifi:

      - repo: ...
        branch: ef61c87311ad2f57484c33245c9ed50908a1c785
        gitFolder: tests/templates/kuttl/custom-components-git-sync/python-processors
        caCertSecretName: git-ca-cert #     <-- Optional new field

Definition of Done Checklist

• Not all of these items are applicable to all PRs, the author should update this template to only leave the boxes in that are relevant
• Please make sure all these things are done and tick the boxes

Author

• Changes are OpenShift compatible
• CRD changes approved
• CRD documentation for all fields, following the style guide.
• Integration tests passed (for non trivial changes)
• Changes need to be "offline" compatible

Reviewer

• Code contains useful comments
• Code contains useful logging statements
• (Integration-)Test cases added
• Documentation added or updated. Follows the style guide.
• Changelog updated
• Cargo.toml only contains references to git tags (not specific commits or branches)

Acceptance

• Feature Tracker has been updated
• Proper release label has been added

[NickLarsenNZ]

caCertSecretName: git-ca-cert #     <-- Optional new field

Would there be a well defined key to lookup within the secret, and can it be overridden?

A similar PR deals with this: stackabletech/secret-operator#679, maybe useful.

---

Also, should we also support CA certificates in ConfigMaps?

[adwk67]

Would there be a well defined key to lookup within the secret, and can it be overridden?

@NickLarsenNZ The secret has single field ca.crt which is passed through to git-config for use with the http.sslCAInfo flag, so it would seem to be independent of the kubernetes distro. I've had a look here and there doesn't seem to be any information as to whether this field name is fixed or not.

If git is built against openssl then it has to be in PEM format, but the name doesn't matter: https://docs.openssl.org/3.3/man3/SSL_CTX_load_verify_locations/#notes