Enable database TLS on 2025.1

[seunghun1ee]

Upstream Kolla-Ansible backported ProxySQL 3.0.x to 2025.1 release.
https://review.opendev.org/c/openstack/kolla-ansible/+/974712
https://review.opendev.org/c/openstack/kolla/+/974429

ProxySQL 3.0.x has a fix for the bug sysown/proxysql#4877 which prevented using TLS between database and ProxySQL.
Re-enable Database TLS and add tasks for creating certificates for ProxySQL.

Note: Two variables database_enable_tls_internal and database_enable_tls_backend have default value true but these are still explicitly set to true to ensure existing systems can also get effect.

[gemini-code-assist]

Code Review

This pull request enables internal and backend database TLS by upgrading ProxySQL to version 3.0.x and adding the necessary certificate generation tasks. A review comment identifies a hardcoded path in the root CA copy task that should be parameterized with the stackhpc_ca_secret_store variable to support different secret store backends.

[Alex-Welsh]

@seunghun1ee what's the intention here? This PR has been stuck in draft for a while. Is it waiting for something else to merge?

[seunghun1ee]

This is currently actively worked on and dependent on https://review.opendev.org/c/openstack/kolla-ansible/+/986381
Once the upstream change is merged, it can be moved to Open state.

[Alex-Welsh]

Should we just include this in 2026.1?

[github-actions]

Happy Friday @seunghun1ee, this is a friendly reminder that this PR is waiting for your changes or response. Please take a look when you have a moment!

Note: Once your changes are ready, remove the waiting-author-response label and add the waiting-review label.