setup database certificates

[boddumanohar]

Fixes: simplyblock/vela#169

The database connection endpoint connects to PGBouncer service. So the changes in PR sets up TLS termination for at PGBouncer.

As a part of this changes, we create the certificate:

• Create the certificate as a part of Helm chart
• update PGBouncer Config to require certificates
• update vm.yaml definition with certificates

On the vela-os side, we first start the PGBouncer without TLS and the then certificates are available, we reload the PGbouncer with Certificates.

It can be observed below that the PGBouncer has intially connect in TLS mode and after a minute, it's connected with TLS.

root@pgbench2:/# psql "postgresql://postgres:itoanlI07fcVZ7vT@db.01kjkn4mby3sft1eqpc4nx0z2f.pr623.dev.kernel-labs.org:31672/postgres"
psql (17.8 (Debian 17.8-1.pgdg13+1), server 18.1)
WARNING: psql major version 17, server major version 18.
         Some psql features might not work.
Type "help" for help.

postgres=> \q
root@pgbench2:/# psql "postgresql://postgres:itoanlI07fcVZ7vT@db.01kjkn4mby3sft1eqpc4nx0z2f.pr623.dev.kernel-labs.org:31672/postgres"
psql (17.8 (Debian 17.8-1.pgdg13+1), server 18.1)
WARNING: psql major version 17, server major version 18.
         Some psql features might not work.
SSL connection (protocol: TLSv1.3, cipher: TLS_AES_256_GCM_SHA384, compression: off, ALPN: postgresql)
Type "help" for help.

postgres=> \q

and on the vela-os side (PR: simplyblock/vela-os#22)

Waiting for certificates...
01/Mar/2026:02:55:56 +0000: Starting PostgREST 14.3...
01/Mar/2026:02:55:56 +0000: API server listening on 0.0.0.0:3000
01/Mar/2026:02:55:56 +0000: Listening for database notifications on the "pgrst" channel
01/Mar/2026:02:55:56 +0000: Successfully connected to PostgreSQL 18.1 on x86_64-linux, compiled by gcc-14.3.0, 64-bit
01/Mar/2026:02:55:56 +0000: Connection Pool initialized with a maximum size of 10 connections
01/Mar/2026:02:55:56 +0000: Config reloaded
01/Mar/2026:02:55:56 +0000: Schema cache queried in 927.6 milliseconds
01/Mar/2026:02:55:56 +0000: Schema cache loaded 3 Relations, 2 Relationships, 4 Functions, 0 Domain Representations, 4 Media Type Handlers, 1196 Timezones
01/Mar/2026:02:55:56 +0000: Schema cache loaded in 7.7 milliseconds
Certificates found. Enabling TLS and reloading PgBouncer...

we wait for certificate and then load then when they become available.