fix(helm): configure TLS for shared control plane and CAS listeners
Pod TLS currently configures only the legacy gRPC listeners. Reuse the existing control-plane and CAS TLS Secret helpers and certificate mounts for the shared HTTP listeners, matching platform PR #6958.
Switch health probes to HTTPS and derive NGINX/Traefik upstream settings and Service appProtocol from the same TLS configuration: kubernetes.io/h2 with TLS, kubernetes.io/h2c without TLS. Preserve the legacy tlsConfig.secret.name fallback, existingSecret precedence, and explicit annotation overrides. Bump the chart to 1.470.1 and document the upgrade behavior.
Deployments that already configure a pod TLS Secret now require TLS on the shared HTTP endpoint too. Public Ingress TLS termination remains independent. Gateway-to-pod TLS policy and certificate trust remain infrastructure-managed.
Validation:
- go test ./deployment/chainloop -count=1 passes for the remaining shared-ingress tests.
- golangci-lint run ./deployment/chainloop/... reports zero issues.
- Helm lint passes with plaintext defaults and with TLS configured for both services.
- git diff --check passes.