fix(tls): bound generated SAN resource usage

[GatewayJ]

Type of Change

• New Feature
• Bug Fix
• Documentation
• Performance Improvement
• Test/CI
• Refactor
• Other: N/A

Related Issues

Closes rustfs/backlog#1094

Summary of Changes

• Validate the projected complete Tenant, each complete cert-manager Certificate, and the final Tenant TLS status against a conservative etcd request budget.
• Fix decimal ordinal accounting for generated pod SANs at 101, 1000, and larger server counts.
• Bound certificate entries before API calls and enforce reconcile-wide PEM/Secret material, parsed DER, and webpki SAN-scan budgets.
• Count duplicate status copies across certificate hosts, per-certificate DNS names, and the default top-level DNS-name compatibility field.
• Stream certificate-chain and CA parsing and retain only required observation data instead of complete Secrets or private keys.
• Preserve webpki concrete DNS matching, exact wildcard matching, and zero-expansion external Secret behavior.

Checklist

• I have read and followed the CONTRIBUTING.md guidelines
• Passed make pre-commit (fmt-check + clippy + test + console-lint + console-fmt-check)
• Added/updated necessary tests
• Documentation updated (if needed) — N/A; no API or configuration field change
• CHANGELOG.md updated under [Unreleased] (if user-visible change)
• CI/CD passed (if applicable)

Impact

• Breaking change (CRD/API compatibility)
• Requires doc/config/deployment update
• Other impact: oversized TLS configurations fail closed with CertificateInvalid before unsafe allocation or Kubernetes writes.

Verification

make pre-commit
cargo test reconcile::tls --lib -- --nocapture

Additional Notes

Complete Kubernetes object checks use etcd's default 1.5 MiB request envelope with a 64 KiB protocol/admission margin. Reconcile-wide limits are 64 certificate entries, 16 MiB of PEM/Secret material, 8 MiB of parsed DER, and 16 MiB of estimated webpki SAN-scan work.

The final implementation was cross-reviewed for full-object accounting, aggregate multi-certificate work, wildcard compatibility, overflow behavior, and validation-before-expansion ordering.

---

Thank you for your contribution! Please ensure your PR follows the community standards (CODE_OF_CONDUCT.md) and sign the CLA if this is your first contribution.