Enable `HTTPS` for source artifact URL defined in `.status.artifact.url`

Enable TLS for source artifact download URL

The current implementation of source controller API ImageRepository and MavenArtifact expose the resulting source artifact at a HTTP URL defined in .status.artifact.url. The source artifact URL is not exposed externally and is only available to in-cluster consumers. This feature request requires TLS for the source artifact download endpoint.

Additional context
An accepted solution for this Proposal must include the requirements listed below.

• Backward compatibility (i.e., deprecate HTTP URL and support existing clients during the deprecated period)
• Support certificate signed by private CA
• Able to consume certificate updates
• In-cluster clients able to trust the certificate

Proposal

• Add a fixed named secret that contains the TLS key and certificate
• Source Controller manager deployment will use the secret in a mounted volume
• Use cert-manager to issue a certificate and rotate expired certificates
• Add a new type, SecureArtifact that has all the existing fields available in the existing Artifact type plus a new field called CABundle. The CABundle is a string field that contains the client certificate key/value pair
• The URL field for SecureArtifact will contain the HTTPS download URL
• Source Controller APIs Status will include SecureArtifact as well as existing Artifact and maintain backward compatibility

Here is a mock shape of the fixed name secret

apiVersion: v1
data:
  ca.crt: …
  tls.crt: …
  tls.key: …
kind: Secret
metadata:
  name: source-server-cert
  namespace: source-system
type: kubernetes.io/tls

Here is a mock of the proposed API status

status:
  artifact:                 # existing type `Artifact`
    ...
    url: "http://..."
  secureArtifact:           # New type `SecureArtifact` = `Artifact` + CABundle
    ...
    url: "https://..."
    caBundle: ""

Testing

• Unit test coverage of the HTTPS feature
• e2e integration test (CI)
• Install with value TLS enabled
• Create ImageRespository resource
• Validate downloaded artifact from HTTPS endpoint
• Create MavenArtifact resource
• Validate downloaded maven artifact from HTTPS endpoint

Start with the source controller API types for ImageRepository and MavenArtifact and the Source Controller manager deployment described in the proposal. Review how status.artifact.url is produced and how the manager mounts configuration, then map the fixed TLS secret, SecureArtifact status, certificate rotation, and backward compatibility requirements. Done includes unit and e2e coverage for HTTPS downloads from both artifact types and the listed TLS installation and trust checks.