Support verified PostgreSQL TLS and private CA trust for Craft sandbox proxies

[jack-watroba]

Problem

The Helm chart exposes the backend's POSTGRES_SSL* settings only through raw config-map values. Operators who use a private PostgreSQL CA must manually mount the CA into every database client workload. This is easy to miss when new workloads are added.

Craft's sandbox proxy has a separate gap: it runs non-root with a read-only root filesystem and was not wired into customCACerts. When ONYX_SERVER_URL uses HTTPS signed by a private CA, the proxy rejects the certificate before forwarding sandbox traffic. Operators have had to point Craft at the internal non-HTTPS API service as a temporary workaround.

Proposed solution

Add two chart-level capabilities:

1. postgresTls accepts a CA from either a Secret or ConfigMap, mounts it across Onyx workloads, and configures verified PostgreSQL TLS through POSTGRES_SSLMODE and POSTGRES_SSLROOTCERT.
2. When customCACerts is enabled, the Craft proxy creates an additive CA bundle in its writable directory. It combines the image's public roots with private .crt roots from the projected Kubernetes volume, follows the volume's symlinks, and supplies the bundle to mitmproxy for upstream TLS validation.

Scope

• Keep both settings disabled by default for backward compatibility.
• Validate that exactly one PostgreSQL CA source is supplied when postgresTls is enabled.
• Preserve public CA trust; do not replace the system bundle with private roots alone.
• Keep the proxy and the bundle-building init container non-root.
• Release the chart with a version bump and document the migration from manual mounts.