Add EJBCA UpstreamAuthority plugin support to spire-server chart (#873)

Add support for the EJBCA UpstreamAuthority plugin, allowing the SPIRE
server to use an EJBCA instance as its upstream CA over mTLS.

- Add upstreamAuthority.ejbca values (hostname, caName, endEntityProfileName,
  certificateProfileName, optional endEntityName and accountBindingId).
- Render the ejbca UpstreamAuthority block in the server config and count it
  toward the single-upstream-authority guard.
- Mount the mTLS client credentials (and optional CA cert) from a secret,
  either chart-created (secret.create) or externally provided.
- Gate ca_cert_path on secret.data.caCert, mirroring the disk plugin's bundle
  handling for deterministic rendering.
- Regenerate the chart README and add a unit render test.

Signed-off-by: sabsari <[email protected]>
Co-authored-by: Claude Opus 4.8 <[email protected]>

charts/spire/charts/spire-server/templates/_helpers.tpl

@@ -164,6 +164,17 @@ Create the name of the service account to use
 {{- end -}}
 {{- end }}
 
+{{- define "spire-server.upstream-ejbca-secret" -}}
+{{- $root := . }}
+{{- with .Values.upstreamAuthority.ejbca -}}
+{{- if eq (.secret.create | toString) "true" -}}
+{{ include "spire-server.fullname" $root }}-upstream-ejbca
+{{- else -}}
+{{ default (include "spire-server.fullname" $root) .secret.name }}
+{{- end -}}
+{{- end -}}
+{{- end }}
+
 {{- define "spire-controller-manager.fullname" -}}
 {{ include "spire-server.fullname" . | trimSuffix "-server" }}-controller-manager
 {{- end }}