Add etcd TLS certificate upload support to gateway_server role

[mazam32-itential]

Summary

• upload_certs.yml previously only copied the main Gateway PKI certs (CA, cert, key). When etcd TLS is enabled with client cert auth (gateway_server_store_etcd_client_cert_auth: true), etcd-specific certificates had to be manually placed on target hosts before running the deployer, breaking its self-contained install model.
• Added three new source variables: gateway_server_store_etcd_ca_cert_src, gateway_server_store_etcd_cert_src, gateway_server_store_etcd_key_src (undefined by default).
• Added new copy tasks in upload_certs.yml, gated on gateway_server_store_etcd_use_tls / gateway_server_store_etcd_client_cert_auth and each source variable being set.
• The existing destination variables (gateway_server_store_etcd_ca_certificate_filename, gateway_server_store_etcd_certificate_filename, gateway_server_store_etcd_private_key_filename) keep their names, but their default value is now conditional: if the matching *_src var is set, it resolves to a new dedicated path (etcd-ca.crt/etcd-client.crt/etcd-client.key under the same PKI directory); otherwise it falls back to the existing shared-with-main-Gateway-PKI path, unchanged. This avoids a customer who supplies a distinct etcd CA silently overwriting the main Gateway mTLS cert file, with no action required from anyone not using this feature.
• Documented the new/changed variables in docs/reference_guide.md and CLAUDE.md.

How this was tested

Defaults resolution (via include_vars, no live host needed) — confirmed the three destination variables resolve correctly in three cases:

• No *_src set → matches today's shared paths exactly (e.g. /etc/gateway/ssl/ca.crt)
• All three *_src set → resolves to the new dedicated paths (etcd-ca.crt/etcd-client.crt/etcd-client.key)
• Partial case (only the CA source set) → confirms each of the three destination variables is independent

This caught a real bug in the first draft: using is defined alone (instead of is not none) to gate the conditional always evaluated true, because the *_src variables are declared (as null) in defaults — meaning the dedicated path was always selected regardless of whether a customer actually set a source. Fixed by switching to is not none.

Actual task execution — ran the real upload_certs.yml file (via include_tasks, not a reimplementation) against localhost with dummy cert files:

• Main Gateway PKI and Connect cert copies correctly skip when their source vars are unset
• All three etcd files copied with correct destination paths, correct permissions (0444/0644/0400), and byte-identical content to the source files

Gating — confirmed independently:

• gateway_server_store_etcd_use_tls: false → nothing uploaded
• TLS enabled, gateway_server_store_etcd_client_cert_auth: false → only the CA cert uploaded, client cert/key tasks skip

Lint: ansible-lint on both changed task/defaults files passes clean (0 failures, 0 warnings).

Test plan for reviewer

• Confirm hosts that don't set any of the new *_src variables see no behavior change
• Optionally reproduce the defaults/task tests above locally
• Confirm the dedicated-path filenames (etcd-ca.crt, etcd-client.crt, etcd-client.key) are acceptable naming