fix(sts): rotate TLS certificates

[GatewayJ]

Type of Change

• New Feature
• Bug Fix
• Documentation
• Performance Improvement
• Test/CI
• Refactor
• Other: N/A

Related Issues

Closes rustfs/backlog#1091

Summary of Changes

• Issue Operator-managed STS CA and server certificates with a one-year validity period and rotate them 30 days before expiry.
• Migrate legacy long-lived managed Secrets through a versioned policy annotation and handle concurrent replica replacement conflicts.
• Poll the TLS Secret every five minutes and hot-load valid material for new connections while retaining the last valid configuration on refresh failures.
• Reject expired or not-yet-valid replacement material and expose leaf and CA expiry timestamp metrics.
• Document automatic and manual rotation, monitoring, and the one-time client CA refresh required for legacy managed Secrets.

Checklist

• I have read and followed the CONTRIBUTING.md guidelines
• Passed make pre-commit (fmt-check + clippy + test + console-lint + console-fmt-check)
• Added/updated necessary tests
• Documentation updated (if needed)
• CHANGELOG.md updated under [Unreleased] (N/A)
• CI/CD passed (pending)

Impact

• Breaking change (CRD/API compatibility)
• Requires doc/config/deployment update
• Other impact: Existing Operator-managed STS TLS Secrets using the legacy policy are regenerated once; clients must refresh the trusted ca.crt during upgrade.

Verification

make pre-commit

Additional Notes

A live Kubernetes rotation was not run locally. Unit tests cover certificate validity, early renewal, legacy migration policy, external-certificate ownership boundaries, expired material rejection, and metrics.

---

Thank you for your contribution! Please ensure your PR follows the community standards (CODE_OF_CONDUCT.md) and sign the CLA if this is your first contribution.