K8SPG-1045: fix certManagementPolicy for pgbouncer

[pooknull]

https://perconadev.atlassian.net/browse/K8SPG-1045

DESCRIPTION

Problem:
PR #1679 added .spec.tls.certManagementPolicy. When set to userProvidedOnly, the operator skips reconcile of the entire pgbouncer secret, including non-TLS values it should manage. Also, when .spec.proxy.pgbouncer.customTLSSecret is configured, the operator validates the standard pgbouncer secret instead of the customTLSSecret.

Solution:
Preserve user-provided TLS values in the standard pgbouncer secret while continuing to reconcile operator-managed non-TLS values. When .spec.proxy.pgbouncer.customTLSSecret is configured, validate that secret instead of the standard pgbouncer Secret.

CHECKLIST

Jira

• Is the Jira ticket created and referenced properly?
• Does the Jira ticket have the proper statuses for documentation (Needs Doc) and QA (Needs QA)?
• Does the Jira ticket link to the proper milestone (Fix Version field)?

Tests

• Is an E2E test/test case added for the new feature/change?
• Are unit tests added where appropriate?

Config/Logging/Testability

• Are all needed new/changed options added to default YAML files?
• Are all needed new/changed options added to the Helm Chart?
• Did we add proper logging messages for operator actions?
• Did we ensure compatibility with the previous version or cluster upgrade process?
• Does the change support oldest and newest supported PG version?
• Does the change support oldest and newest supported Kubernetes version?