test(8.8): cover Zeebe TLS migration upgrade

[eamonnmoloney]

Summary

• Adds a Zeebe internal TLS feature to the 8.7 -> 8.8 elasticsearch-self-signed-upgrade scenario.
• Creates the camunda-zeebe-tls Secret before the 8.7 source install so the Secret is reused through the upgrade instead of rotating mid-migration.
• Extends lifecycle hook coverage for the cross-version 8.7 pre-install wrapper used by the 8.8 upgrade scenario.

Validation

• go test ./matrix
• make helm.dependency-update chartPath=charts/camunda-platform-8.7
• make helm.dependency-update chartPath=charts/camunda-platform-8.8
• Helm render checks for 8.7 StatefulSet and 8.8 importer/data migration TLS env and mounts
• bash -n charts/camunda-platform-8.7/test/integration/scenarios/pre-setup-scripts/create-zeebe-tls-secret.sh plus local fake-kubectl run confirmed the generated Zeebe cert includes DNS/IP SANs
• deploy-camunda matrix list confirmed features=migrator,zeebe-tls
• GKE repo-backed validation passed for esss upgrade in 11m31s
• Seeded-data GKE validation passed in namespace inc33081-h7-data-gke:
  • deployed 8.7 with Elasticsearch self-signed TLS plus Zeebe TLS
  • seeded real process data with tests/SM-8.7/smoke-tests.spec.ts / Most Common Flow User Flow With All Apps
  • upgraded the same namespace to 8.8 with features migrator,zeebe-tls
  • migration job completed with operate-import-position-8.3.0_ total=36 pending=0 and tasklist-import-position-8.2.0_ total=19 pending=0
  • importer logs showed gateway cluster messaging started using TLS

Links

• Originating issue: SUPPORT-33081 / INC-5824
• Docs counterpart: docs(8.8): document Zeebe TLS migration settings camunda-docs#8977
• E2E counterpart: not needed