[ws-manager] Support custom CA certs

[csweichel]

Description

Adds custom CA cert support to workspaces.

Related Issue(s)

Fixes #9079

How to test

1. Ensure that ws-manager's config carries caCertSecret entry (done on this branch)
2. Start a workspace on https://cw-fix-9079.staging.gitpod-dev.com/workspaces
3. Cat the custom cert from cat /etc/ssl/certs/gitpod-ca.crt

Release Notes

Add custom CA cert support to workspaces

[sagor999]

@csweichel code looks good, but when I do cat /etc/ssl/certs/gitpod-ca.crt it shows me BEGIN RSA PRIVATE KEY, which I think is wrong, since crt should be public part of the cert, and gitpod-ca.key should be the private key.
So want to make sure we map this correctly.

[csweichel]

@csweichel code looks good, but when I do cat /etc/ssl/certs/gitpod-ca.crt it shows me BEGIN RSA PRIVATE KEY, which I think is wrong, since crt should be public part of the cert, and gitpod-ca.key should be the private key. So want to make sure we map this correctly.

That's right - my bad. I just stuffed the wrong file into the secret. We're just mounting the secret directly into the workspace, irregardless of its content. It's up to the user to ensure there's a valid CA cert (not a key) in there.

We could add validation to the installer to ensure it's a CA cert.