feat: add PKCS#11 E2E test pipeline

[sampras343]

Summary

• Adds PKCS#11/HSM E2E testing that runs in parallel with existing file-mode tests on the same EaaS cluster
• New run-tas-pkcs11-e2e pipeline task deploys a PKCS#11-mode SecureSign CR in a separate namespace (sigstore-pkcs11-test) alongside the file-mode deployment (sigstore-e2e-test)
• No additional cluster provisioning — both stacks share the same operator install and cluster

New files

• stepactions/integration-test/install-pkcs11-prerequisites.yaml — SoftHSM setup, key ceremony Jobs, derived Secrets
• stepactions/integration-test/install-tas-pkcs11.yaml — PKCS#11-mode SecureSign CR deployment
• tasks/integration-test/sigstore-e2e-pkcs11.yaml — Full E2E task with PKCS#11 prerequisites + sigstore tests

Pipeline execution graph

prepare-tests ──┬──► run-operator-e2e
                ├──► run-tas-e2e          (sigstore-e2e-test, file mode)
                └──► run-tas-pkcs11-e2e   (sigstore-pkcs11-test, PKCS#11 mode)

Test plan

• Validate YAML syntax and Tekton schema
• Test PKCS#11 prerequisite scripts on a live cluster
• Full pipeline run via Konflux IntegrationTestScenario

Dependencies

• Requires operator PR feat: add PKCS#11/HSM signer support for Fulcio and CTLog secure-sign-operator#2182 (PKCS#11/HSM signer support) to be merged