Mount trusted CA in all jobs to enable end-to-end PostgreSQL sslmode=verify-full support

Is your feature request related to a problem? Please describe.
When using custom CA support in pulp-operator with mount_trusted_ca: true and mount_trusted_ca_configmap_key, the trusted CA bundle is mounted in the main pulpcore pods (api, content, and worker). However, the operator-created jobs used for migration, reset-admin-password, and update-content-checksums do not mount the trusted CA bundle.

Because of this, PostgreSQL connections that require strict certificate validation with sslmode=verify-full cannot be used consistently across the whole solution. Even if the main pods are configured correctly, these jobs may fail because they cannot validate the database server certificate.

Describe the solution you'd like
Please extend the operator so that the trusted CA bundle is also mounted in the following jobs whenever mount_trusted_ca: true is enabled:

• migration
• reset-admin-password
• update-content-checksums

Ideally, these jobs should reuse the same CA mounting logic already used by the main pulpcore deployments, so that the full solution supports sslmode=verify-full consistently.

Describe alternatives you've considered

• Patching the operator locally to add the trusted CA volume and volume mount to the affected jobs.
• Avoiding sslmode=verify-full, which is not acceptable in environments that require strict TLS verification for compliance or security reasons.

Additional context

• The reusable helpers already exist in controllers/utils.go: SetCAVolumes and SetCAVolumeMounts.
• The main pulpcore deployments already use this logic, but the jobs in controllers/repo_manager/job.go do not.
• This creates an inconsistency where trusted CA support is only partial.
• Supporting this in all jobs would make deployments against managed PostgreSQL services and custom enterprise PKI setups much more reliable.

Thank you for maintaining the operator and its documentation.

Start in controllers/repo_manager/job.go and compare the migration, reset-admin-password, and update-content-checksums jobs with the existing CA handling in controllers/utils.go. Trace SetCAVolumes and SetCAVolumeMounts, then verify that all three jobs mount the trusted CA when mount_trusted_ca is enabled and leave it absent otherwise.