conrad/teach proxy compute tls

[conradludgate]

https://github.com/neondatabase/cloud/issues/23008

For TLS between proxy and compute, we are using an internally provisioned CA to sign the compute certificates. This change ensures that proxy will load them from a supplied env var pointing to the correct file - this file and env var will be configured later, using a kubernetes secret.

To use TLS, we need a hostname. For now, we decided to use the kubernetes service name as it seemed most appropriate - eg compute-id.default.svc.cluster.local. (see https://kubernetes.io/docs/concepts/services-networking/dns-pod-service/). This is very neon specific and would break if we ever decided to use different namespaces for each endpoint. Since control-plane is what creates the service, we should update the wake compute response appropriately, but I think this is a suitable first pass

Compute doesn't offer TLS yet, so I have it set to "Prefer", which allows TLS but is fine if it's not enabled - this allows us to roll out. This should be configurable.

[github-actions]

7425 tests run: 7067 passed, 0 failed, 358 skipped (full report)

---

Flaky tests (2)

Postgres 16

• test_pull_timeline_while_evicted: release-x86-64-with-lfc

Postgres 14

• test_location_conf_churn[3]: release-arm64-with-lfc

Code coverage* (full report)

• functions: 33.2% (8585 of 25827 functions)
• lines: 49.1% (72297 of 147290 lines)

* collected from Rust tests only

---

_{The comment gets automatically updated with the latest test results
762dafc at 2025-02-07T17:51:21.910Z :recycle:}