feat(mongodb): support TLS for replica set and sharding clusters

[gnolong]

Summary

• Support native KubeBlocks TLS certificate projection for MongoDB replica set, config server, shard and mongos components.
• Combine the mounted certificate/key under /etc/mongodb/tls/mongodb.pem with restrictive permissions in the container writable layer, without adding an emptyDir.
• Configure TLS through startup arguments only. Use legacy --ssl* options for the supported MongoDB 4.0 release and modern --tls* options for 4.2 and later, selected from the component service version.
• Make shell probes, shard management, PBM sidecar and exporter connections TLS-aware. Match replica set member DNS names to certificate SANs.
• Keep plaintext behavior when TLS is disabled or unset, and retain focused ShellSpec coverage.

The local addons/mongodb/tests/ directory and addons/mongodb/TLS.md are intentionally excluded. ShellSpec does not reference the excluded tests.

Dependency and usage

Depends on https://github.com/apecloud/syncer/pull/388 and a Syncer image containing that change. The default Syncer tag is unchanged in this PR; the test environment overrides image.syncer.tag=mongodb-tls-734c281.

Enable TLS by patching the Cluster component tls and issuer fields. For sharding, enable it on config server, mongos and the sharding template, with a UserProvided shared CA covering all member DNS names. Per-component KubeBlocks-generated CAs do not provide cross-component trust.

TLS is not added to configuration files or Reconfiguring OpsRequest parameters. Enabling it replaces Pods and directly requires TLS, so this is not a zero-downtime plaintext-to-TLS migration. Managed clients intentionally use insecure TLS; server-to-server certificate verification remains enabled. Rebuilding the combined PEM after certificate-only rotation is not implemented here.

Validation

• 89 MongoDB ShellSpec examples passed after excluding the local render-test invocation.
• Helm lint, ShellCheck and git diff checks passed. Additional local-only render/version-selection checks passed but are not included in this PR.
• Four cases passed sequentially in the existing kb-addon-main-test k3d environment, using KubeBlocks main image main-13138f46 and the unchanged Syncer test image mongodb-tls-734c281:

Architecture	MongoDB 4.0.28	MongoDB 8.0.17
Replica set	Passed, legacy SSL options	Passed, TLS options
Sharding	Passed, legacy SSL options	Passed, TLS options

Each case started without TLS, wrote baseline data, and enabled TLS by patching the Cluster CR. Checks covered Pod replacement, actual startup argv, no TLS settings in config files, strict-CA read/write, retained baseline data, plaintext rejection and Syncer role detection. Both sharding cases also passed the management script's read-only shard existence check over TLS. Actual Percona versions were 4.0.28-23 and 8.0.17-6.

Tests used a single-member replica set or one config server, one mongos and one single-member shard, with 1 GiB data PVCs. Existing setup workarounds were kept separate from this PR: manifests explicitly supplied root passwordConfig, and sharding provision order was temporarily removed to avoid the existing config-server/mongos reference cycle. Original provision, update and termination orders were restored before each TLS patch.

Intermediate versions only received local option-selection coverage. Backup/restore, PITR, custom OpsDefinition clients, certificate rotation, multi-member HA and zero-downtime migration were not tested.

[codecov-commenter]

Codecov Report

❌ Patch coverage is 0% with 79 lines in your changes missing coverage. Please review.
✅ Project coverage is 0.00%. Comparing base (ce67f5a) to head (4952688).
⚠️ Report is 11 commits behind head on main.

Files with missing lines	Patch %	Lines
addons/mongodb/scripts-ut-spec/tls_spec.sh	0.00%	62 Missing ⚠️
...s/mongodb/scripts-ut-spec/replicaset_setup_spec.sh	0.00%	17 Missing ⚠️

Additional details and impacted files

@@          Coverage Diff          @@
##            main   #3456   +/-   ##
=====================================
  Coverage   0.00%   0.00%           
=====================================
  Files        192     193    +1     
  Lines      27227   27305   +78     
=====================================
- Misses     27227   27305   +78     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[gnolong]

how otld connects to mongodb when tls is enabled?