CSPL-4878: Add operator-driven TLS certificate configuration for server and input (S2S) certs

[minjieqiu]

Summary

Introduces Ansible support for mounting and configuring TLS certificates delivered by the Splunk Operator (SOK) as Kubernetes Secrets. This is the format-adaptor layer of the SOK Certificate Management design (Phase 1).

• Adds configure_splunk_certs.yml — dispatcher that checks for operator-mounted cert directories under /mnt/tls/ and conditionally includes per-cert-type tasks. If a cert directory is absent, Ansible skips it entirely with no error.
• Adds configure_server_cert.yml — reads tls.crt, tls.key, ca.crt from /mnt/tls/splunk-server-tls-cert/, generates an ephemeral passphrase, encrypts the private key, bundles cert+key into splunk-server-bundle.pem, and configures server.conf [sslConfig] (serverCert, sslPassword, sslRootCAPath).
• Adds configure_input_cert.yml — same flow for S2S input cert, reads from /mnt/tls/splunk-input-tls-cert/, configures inputs.conf [SSL], outputs splunk-input-bundle.pem and splunk-input-ca.pem.
• Wires configure_splunk_certs.yml into main.yml before the existing enable_splunkd_ssl.yml step, gated on Linux only.

Design Notes

• Non-breaking: cert processing is fully conditional on directory existence. Existing deployments without operator-mounted certs are unaffected.
• Extensible: adding a new cert type (e.g. web) requires only a new stat + include_tasks entry in the dispatcher and a corresponding task file.
• Ephemeral passphrase: a new random passphrase is generated at each pod startup to meet Splunk's bundled cert format requirement. The passphrase is not persisted.
• Output file naming: consistent splunk-<role>-bundle.pem / splunk-<role>-ca.pem pattern across all cert types.

Test Plan

• Deploy SOK with these Ansible changes baked into the Splunk image
• Deploy Standalone with no cert secret — verify Ansible skips cert configuration cleanly
• Create splunk-server-tls-cert secret with tls.crt, tls.key, ca.crt — verify splunk-server-bundle.pem created and server.conf [sslConfig] configured correctly
• Create splunk-input-tls-cert secret — verify splunk-input-bundle.pem created and inputs.conf [SSL] configured correctly
• Verify Splunk REST endpoint (port 8089) and S2S port (9997) accept TLS connections using the configured certs