[TSLA-11619] Make GetKeyCertPEM select key/cert pair deterministically

[RoryDoherty]

Description

What

GetKeyCertPEM ranged over a Go map of key/cert field-name pairs, so when a
secret held more than one recognized pair (e.g. standard tls.crt/tls.key
alongside a legacy cert/key kept during a cert-rotation overlap), the
returned cert was non-deterministic due to randomized map iteration.

Why

For the Voltron tunnel secret this flipped the KeyPair hash annotation between
reconciles, changing the tigera-manager pod template hash and triggering
spurious Voltron rolling restarts that dropped managed-cluster tunnels.

Fix

Select the key/cert pair in a fixed priority order (standard tls.crt/tls.key
first, then legacy names). Adds a regression test asserting deterministic
selection when both pairs are present.

Release Note

NONE

For PR author

• Tests for change.
• If changing pkg/apis/, run make gen-files
• If changing versions, run make gen-versions

For PR reviewers

A note for code reviewers - all pull requests must have the following:

• Milestone set according to targeted release.
• Appropriate labels:
  • kind/bug if this is a bugfix.
  • kind/enhancement if this is a a new feature.
  • enterprise if this PR applies to Calico Enterprise only.

[Brian-McM]

/sem approve

[Brian-McM]

/sem-approve

[Brian-McM]

/sem-approve