feat(repo-server): Declare custom trust certs for repo-server and plugins

[olivergondza]

What type of PR is this?

/kind enhancement

What does this PR do / why we need it:

Permit users to trust CAs on a repo-server system level

Have you updated the necessary documentation?

• Documentation update is required by this PR.
• Documentation has been updated.

Which issue(s) this PR fixes:

Fixes #1830

How to test changes / Special notes to the reviewer:

Can be tested against:

k3d cluster create localtest \
              --k3s-arg "--kube-apiserver-arg=feature-gates=ClusterTrustBundle=true,ClusterTrustBundleProjection=true@server:*" \
              --k3s-arg "--kube-apiserver-arg=runtime-config=certificates.k8s.io/v1beta1/clustertrustbundles=true@server:*" \
              --k3s-arg "--kubelet-arg=feature-gates=ClusterTrustBundle=true,ClusterTrustBundleProjection=true@agent:*" \
              --image rancher/k3s:v1.33.0-k3s1

[olivergondza]

Compared to the proposal in #1876, it turned out 1 init container is enough. Also, this implements DropImageAnchors to suppress whatever CAs was in the image originally.

[olivergondza]

/ok-to-test

[olivergondza]

The "Code scans / Run golangci-lint and gosec (pull_request)" failure to be adressed by #1880

[olivergondza]

The test failures are related to the fact the code depends on a tech-preview features. Any advise on how to handle such functionality?

https://github.com/argoproj-labs/argocd-operator/actions/runs/17917840047/job/50944661583?pr=1876#step:11:45

[anandf]

Can it be SecretRefs instead of SecretProjection ? What is the advantage we get by using SecretProjection instead of referring a Secret directly which can be read directly by the operator code.

[olivergondza]

Good question, projections are the only way (I know off), to create a single volume from multiple sources. So this can combine all three kinds of sources in any quantity, and the entries will be merged in a single directory making the init container completely agnostic of files' origin.

If customers are to create the Secret or CM manually, using only one resource might not be that much to ask. But ability to merge them permits seemless integration with signed ClusterTrustBundles that are likely to have more than one resource.

[olivergondza]

@jannfis, after your review, this is the added feature of change detection: 9c3639c