fix: refactor tls secrets to use new pattern

[bkenez]

Which problem does the PR fix?

Closes: #4240
Closes: #4048

Refactors global.elasticsearch.tls, global.opensearch.tls, and console.tls to use the new grouped secret object pattern for consistency with other components like global.license.secret and identity.firstUser.secret.

What's in this PR?

This PR migrates TLS secret configurations from the legacy flat structure (existingSecret) to the new grouped pattern with secret.existingSecret and secret.existingSecretKey, bringing consistency across the Helm chart's secret management. The implementation adds helper functions in _helpers.tpl to handle both patterns for backwards compatibility, updates Orchestration and Optimize templates to use these helpers instead of hardcoded "externaldb.jks" references, and refactors Console to use the new secret.existingSecret pattern. The inlineSecret field is intentionally omitted from TLS configurations because certificates must be properly signed and managed externally rather than defined inline in values files. Console retains certKeyFilename instead of using existingSecretKey because it mounts the entire certificate directory rather than individual files with subPath. All changes are validated by unit tests.

Docs PR: camunda/camunda-docs#7216

Checklist

Please make sure to follow our Contributing Guide.

Before opening the PR:

• In the repo's root dir, run make go.update-golden-only.
• There is no other open pull request for the same update/change.
• Tests for charts are added (if needed).
• In-repo documentation are updated (if needed).

After opening the PR:

• Did you sign our CLA (Contributor License Agreement)? It will show once you open the PR.
• Did all checks/tests pass in the PR?