Add private CA support

[zbindenren]

Feature Request: Custom CA Certificate Support for Self-Signed Certificates

Summary

The COSI driver cannot use private CA certificates for TLS connections. The only options are full system CA validation or completely disabling TLS verification, which is insecure.

Affected Files

• pkg/config/config.go
• pkg/clients/s3/s3.go
• pkg/clients/iam/iam.go
• pkg/clients/admin/admin.go
• helm/cosi-driver/values.yaml
• helm/cosi-driver/templates/deployment.yaml

Current Behavior

TLS configuration only supports a binary toggle:

// pkg/clients/s3/s3.go (identical in iam.go and admin.go)
tr := &http.Transport{
    TLSClientConfig: &tls.Config{InsecureSkipVerify: config.DisableTLSCertificateChecking},
}

# values.yaml
disableTLSCertificateCheck: false

Security Concerns

1. All-or-Nothing TLS: Users with self-signed certificates must disable ALL TLS verification
2. MITM Vulnerability: Disabling TLS verification exposes connections to man-in-the-middle attacks
3. No Private CA Support: Enterprise environments with internal CAs cannot securely connect