Add first-class trust bundle support for Zitadel and login pods

[mridang]

Preflight Checklist

• I could not find a solution in the existing issues, docs, nor discussions
• I have joined the ZITADEL chat

Describe your problem

The chart only supports a DB root CA (zitadel.dbSslCaCrt*) and has no first-class way to inject a general trust bundle for outbound HTTPS/mTLS from the main Zitadel container or the login UI. Today operators must hack this via extra volumes and manual env vars (SSL_CERT_FILE, SSL_CERT_DIR, NODE_EXTRA_CA_CERTS), which is undocumented and inconsistent.

Describe your ideal solution

As a chart maintainer, I want a standard trust bundle input for both Zitadel and login pods (e.g., a Secret/ConfigMap with a CA bundle) that is mounted at a known path and wired via consistent env vars (SSL_CERT_FILE or SSL_CERT_DIR). Avoid component-specific envs like NODE_EXTRA_CA_CERTS; provide a single, documented path/variable that works for both containers.

Files to remove/modify:

• Add values for a trust bundle (Secret/ConfigMap name/key, mount path) for Zitadel and login
• Mount the bundle in templates/deployment_zitadel.yaml and templates/deployment_login.yaml and set SSL_CERT_FILE/SSL_CERT_DIR accordingly
• Document usage in values/README; keep DB CA handling separate

Version

None.

App version

5.x/5.x

Additional Context

This should give a single, consistent way to load CA certificates for outbound calls from both containers without ad hoc env hacks.

[fforootd]

relates to zitadel/zitadel#11563