fix: remove --gateway-insecure by adding route FQDN to cert SAN and automating CA trust

[LinoyBitan1]

Summary

Fix gateway TLS verification end-to-end by adding the external route FQDN to the gateway certificate SANs and automating CA certificate distribution to the CLI.

Stop requiring --gateway-insecure by putting the route FQDN on the gateway cert SAN and copying the CA to the CLI.
The cert was issued only for host.openshell.internal, so the CLI rejected the OpenShift route hostname. Cloud-init
writes a systemd drop-in with --server-san ; the setup Job daemon-reloads and restarts the gateway so that drop-in is used. The Job then puts the VM CA in Secret -gateway-ca. make openshell-saw-configure-gateway copies it to ~/.config/openshell/gateways//mtls/ca.crt before registering the gateway, and fails if the Secret is missing.

--gateway-insecure is removed from Makefile targets, README, and helper scripts.

Jira: APPENG-5921

Background

The openshell CLI already supports trusting a custom CA at ~/.config/openshell/gateways/<name>/mtls/ca.crt, but two things prevented it from working:

1. SAN mismatch — the gateway generated its TLS certificate with --server-san host.openshell.internal, but the external route hostname (e.g. openshell-saw-gateway-openshell-agents.apps.<cluster>) was not included. The CLI rejected the certificate with certificate not valid for name.
2. No CA distribution — the gateway's CA stayed on the VM and was never copied to the client, so the CLI could not verify the server certificate even if the SANs matched.

As a result, every CLI invocation required --gateway-insecure.

Changes

• _helpers.tpl — openshell-sandbox.routeHost computes the external route FQDN from route.host or global.clusterDomain.
• cloudinit-sandbox.yaml — writes OPENSHELL_ROUTE_FQDN into gateway.env and a user systemd drop-in (route-san.conf) that adds the route FQDN as an extra --server-san.
• upgrade-openshell.sh — daemon-reload && restart of the user gateway unit so the drop-in is picked up after the binary upgrade (first-boot setup may already have loaded the unit before the drop-in existed).
• export-ca-cert.sh — new setup Job phase: SSH the CA off the VM into Secret <name>-gateway-ca; return 1 if the file is missing so the Job retries instead of succeeding with no Secret.
• run-setup.sh — sources export-ca-cert.sh after the OpenShell upgrade.
• openshell-saw-create.sh — sets route.host from the cluster ingress domain so the quickstart path always has a FQDN.
• Makefile-quickstart — removed --gateway-insecure. configure-gateway copies the CA from the Secret into mtls/ca.crt, fails if it is missing, then gateway add / select.
• README.md — removed --gateway-insecure from examples.
• demo-governance.sh, governance-profile.sh, openshell-saw-gui.sh — removed --gateway-insecure and grep -v 'TLS certificate' pipes.

Verification

• Gateway certificate includes the external route FQDN in its SANs
• make openshell-saw-configure-gateway copies the CA certificate to the CLI config
• openshell sandbox list works without --gateway-insecure
• No TLS warnings appear in CLI output
• --gateway-insecure is fully removed from Makefile targets and README