fix(module): base64 encoding for custom certificate Secret template

[diafour]

Description

Override helm_lib_module_https_copy_custom_certificate template from the helm-lib, add base64 for Secret fields.

Why do we need it, and what problem does it solve?

Fix of regression after rewrite copy_custom_certificate in Go. helm-lib expects base64 encoded certificates in values, but common hook returns raw strings.

Custom certificate specified in ModuleConfig/global in spec.settings.modules.https.customCertificate.secretName leads to this error:

helm upgrade failed: cannot patch "ingress-tls-customcertificate" with kind Secret ... invalid value: "{ ... \"data\":{\"tls.crt\":\"-----BEGIN CERTIFICATE----....

What is the expected result?

Checklist

• The code is covered by unit tests.
• e2e tests passed.
• Documentation updated according to the changes.
• Changes were tested in the Kubernetes cluster manually.

Changelog entries

section: module
type: fix
summary: Fix helm template to be compatible with CustomCertificate https mode.

[diafour]

Tested in cluster with global self-signed certificate and VirtualImage type Upload:

openssl s_client -showcerts -servername virtualization.CLUSTER_DOMAIN -connect virtualization.CLUSTER_DOMAIN:443 </dev/null
Connecting to aa.bbb.cc.ddd
CONNECTED(00000005)
depth=0 C=RU, CN=*.CLUSTER_DOMAIN
verify error:num=20:unable to get local issuer certificate
verify return:1
depth=0 C=RU, CN=*.CLUSTER_DOMAIN
verify error:num=21:unable to verify the first certificate
verify return:1
depth=0 C=RU, CN=*.CLUSTER_DOMAIN
verify return:1
---
Certificate chain
 0 s:C=RU, CN=*.CLUSTER_DOMAIN
   i:C=RU, CN=CLUSTER_DOMAIN
   a:PKEY: rsaEncryption, 2048 (bit); sigalg: RSA-SHA256
   v:NotBefore: Aug  4 10:05:24 2025 GMT; NotAfter: Jul 26 10:05:24 2026 GMT
-----BEGIN CERTIFICATE-----
...
...
-----END CERTIFICATE-----
---
Server certificate
subject=C=RU, CN=*.CLUSTER_DOMAIN
issuer=C=RU, CN=CLUSTER_DOMAIN
---
No client certificate CA names sent
Peer signing digest: SHA256
Peer signature type: RSA-PSS
Server Temp Key: X25519, 253 bits
---
SSL handshake has read 1458 bytes and written 422 bytes
Verification error: unable to verify the first certificate
---
New, TLSv1.3, Cipher is TLS_AES_256_GCM_SHA384
Protocol: TLSv1.3
Server public key is 2048 bit
This TLS version forbids renegotiation.
Compression: NONE
Expansion: NONE
No ALPN negotiated
Early data was not sent
Verify return code: 21 (unable to verify the first certificate)
---
DONE

[diafour]

/backport v0.23.1

[deckhouse-BOaTswain]

Cherry pick PR 1308 to the branch release-0.23 successful!