[TSLA-11619] Make GetKeyCertPEM select key/cert pair deterministically (cherry-pick #5008, 1.43)

[tmjd]

Description

Cherry-pick of #5008 to release-v1.43.

Bug fix. GetKeyCertPEM ranged over a Go map of key/cert field-name pairs, so when a secret held more than one recognized pair (e.g. standard tls.crt/tls.key alongside a legacy cert/key kept during a cert-rotation overlap), the returned cert was non-deterministic due to randomized map iteration. For the Voltron tunnel secret this flipped the KeyPair hash annotation between reconciles, changing the tigera-manager pod template hash and triggering spurious Voltron rolling restarts that dropped managed-cluster tunnels.

The fix selects the key/cert pair in a fixed priority order (standard tls.crt/tls.key first, then legacy names) and adds a regression test asserting deterministic selection when both pairs are present.

Affects pkg/tls/certificatemanagement. Clean cherry-pick from master (b28e353d); pkg/tls/certificatemanagement package tests pass.

Release Note

NONE

For PR author

• Tests for change.
• If changing pkg/apis/, run make gen-files
• If changing versions, run make gen-versions

For PR reviewers

A note for code reviewers - all pull requests must have the following:

• Milestone set according to targeted release.
• Appropriate labels:
  • kind/bug if this is a bugfix.
  • kind/enhancement if this is a a new feature.
  • enterprise if this PR applies to Calico Enterprise only.