K8SPG-1150: added spec.tls.SANs

[yoav-katz]

Problem:
Every SAN on an operator-issued certificate is derived from naming.ServiceDNSNames plus
spec.clusterServiceDNSSuffix. There is no way for a user to add a name of their own, so
sslmode=verify-full fails for anyone reaching Postgres or pgBouncer through a name the
operator does not know about: an external hostname, a blue/green or per-tenant CNAME, a
legacy name kept through a migration, a wildcard, or a corporate/air-gapped DNS zone.

An external-DNS integration would only ever cover the single hostname external-DNS manages.

Solution:
Add an optional spec.tls.SANs list, appended to the DNS names of the Postgres server
certificate and the pgBouncer frontend certificate, on both the cert-manager and the
internal-PKI paths.

The API is a deliberate copy of the MySQL operators, which already ship this exact field
(SANs []string with json tag SANs, flat-appended onto DNSNames).
Our TLSSpec was already nearly field-identical to PXC's, so this is a one-field addition with no new API shape.

Also fixes a latent bug this feature depends on: the "existing Certificate" branch of
ApplyClusterCertificate/ApplyPGBouncerCertificate reconciled only ownerRefs, duration
and issuerRef - never Spec.DNSNames. Without that, setting SANs on an already-running
cluster was a permanent no-op. ApplyPGBackRestClientCertificate already did this
correctly; the fix copies its shape.

Known limitation, matching MySQL: a bare IP entry becomes a dNSName SAN, not an
iPAddress SAN, so verify-full against an IP still fails. Making it work means
threading ipAddresses []net.IP through internal/pki and its 7 call sites - deferred,
marked with a comment at the append site.

CHECKLIST

Jira

• Is the Jira ticket created and referenced properly?
• Does the Jira ticket have the proper statuses for documentation (Needs Doc) and QA (Needs QA)?
• Does the Jira ticket link to the proper milestone (Fix Version field)?

Tests

• Is an E2E test/test case added for the new feature/change?
• Are unit tests added where appropriate?

Config/Logging/Testability

• Are all needed new/changed options added to default YAML files?
• Are all needed new/changed options added to the Helm Chart?
• Did we add proper logging messages for operator actions?
• Did we ensure compatibility with the previous version or cluster upgrade process?
• Does the change support oldest and newest supported PG version?
• Does the change support oldest and newest supported Kubernetes version?

[JNKPercona]

Test Name	Result	Time
backup-enable-disable	passed	00:12:08
builtin-extensions	failure	00:05:33
custom-extensions	passed	00:17:43
cert-manager-tls	passed	00:11:48
cert-management-policy	passed	00:05:32
custom-envs	passed	00:21:00
custom-tls	passed	00:07:37
database-init-sql	passed	00:03:20
demand-backup	passed	00:25:00
demand-backup-offline-snapshot	passed	00:14:34
dynamic-configuration	passed	00:03:27
extra-volumes	passed	00:04:24
finalizers	passed	00:04:21
init-deploy	passed	00:03:06
huge-pages	passed	00:04:58
logical-replica	passed	00:13:09
major-upgrade-14-to-15	passed	00:11:26
major-upgrade-15-to-16	passed	00:11:33
major-upgrade-16-to-17	passed	00:11:13
major-upgrade-17-to-18	passed	00:14:17
major-upgrade-18-to-19	passed	00:10:32
major-upgrade-logical-replica	passed	00:11:21
ldap	passed	00:05:59
ldap-tls	passed	00:09:32
logcollection	passed	00:07:04
monitoring	passed	00:10:35
operator-upgrade-cert-manager	passed	00:13:13
operator-upgrade-extensions	passed	00:11:49
one-pod	passed	00:06:21
repo-host-autogrow	passed	00:01:53
operator-self-healing	passed	00:11:01
pgbouncer	passed	00:08:00
pg-tde	passed	00:12:15
pg-tde-wal-encrypt	passed	00:21:20
pitr	passed	00:13:24
scaling	passed	00:05:14
scheduled-backup	passed	00:24:50
self-healing	passed	00:09:59
sidecars	passed	00:02:58
standby-pgbackrest	passed	00:19:44
standby-streaming	passed	00:16:32
start-from-backup	passed	00:12:39
start-from-volumes	passed	00:04:01
tablespaces	passed	00:07:30
telemetry-transfer	passed	00:05:08
upgrade-consistency	passed	00:06:29
upgrade-minor	passed	00:16:26
users	passed	00:05:51
migration-from-crunchy-standby	passed	00:19:05
migration-from-crunchy-pv	passed	00:09:40
migration-from-crunchy-backup-restore	passed	00:17:02

Summary	Value
Tests Run	51/51
Job Duration	01:45:33
Total Test Time	09:04:00

commit: 2ae23c2
image: perconalab/percona-postgresql-operator:PR-1813-2ae23c236