Add EJBCA UpstreamAuthority plugin support to spire-server chart (#873)

Add support for the EJBCA UpstreamAuthority plugin, allowing the SPIRE
server to use an EJBCA instance as its upstream CA over mTLS.

- Add upstreamAuthority.ejbca values (hostname, caName, endEntityProfileName,
  certificateProfileName, optional endEntityName and accountBindingId).
- Render the ejbca UpstreamAuthority block in the server config and count it
  toward the single-upstream-authority guard.
- Mount the mTLS client credentials (and optional CA cert) from a secret,
  either chart-created (secret.create) or externally provided.
- Gate ca_cert_path on secret.data.caCert, mirroring the disk plugin's bundle
  handling for deterministic rendering.
- Regenerate the chart README and add a unit render test.

Signed-off-by: sabsari <[email protected]>
Co-authored-by: Claude Opus 4.8 <[email protected]>

tests/unit/spire_test.go

@@ -118,6 +118,28 @@ spire-server:
 			Expect(notes).Should(ContainSubstring("\"aws_pca\": {"))
 		})
 	})
+	Describe("spire-server.UpstreamAuthority.ejbca", func() {
+		It("plugin set ok", func() {
+			objs, err := ValueStringRender(chart, `
+spire-server:
+  upstreamAuthority:
+    ejbca:
+      enabled: true
+      hostname: ejbca.example.org:8443
+      caName: SpireIntermediateCA
+      endEntityProfileName: SpireEEP
+      certificateProfileName: SpireIntermediateCACP
+      secret:
+        data:
+          caCert: dummy-ca
+`)
+			Expect(err).Should(Succeed())
+			notes := objs["spire/charts/spire-server/templates/configmap.yaml"]
+			Expect(notes).Should(ContainSubstring("\"ejbca\": {"))
+			Expect(notes).Should(ContainSubstring("SpireIntermediateCA"))
+			Expect(notes).Should(ContainSubstring("ca_cert_path"))
+		})
+	})
 	Describe("spire-agent.customPlugin.tpm", func() {
 		It("plugin set ok", func() {
 			objs, err := ValueStringRender(chart, `