Enhancement: configurable TLS profile (min TLS version, cipher suites, curves) for terminating endpoints

[nhegde07]

Summary

SPIRE Controller Manager exposes TLS-terminating listeners that need configurable TLS security profile settings for hardened and compliance-driven deployments. Operators should be able to configure:

• minimum TLS version
• cipher suites (TLS 1.2)
• curve / KEM preferences

This mirrors the direction proposed for SPIRE in spiffe/spire#7168, but scoped to the controller manager's YAML configuration and its TLS-terminating surfaces.

Problem / motivation

A single experimental or PQ-focused knob is insufficient when a deployment must enforce a broader TLS posture, for example:

• require TLS 1.3 minimum on the admission webhook
• restrict cipher suites on the webhook HTTPS listener
• prefer specific curves (including PQ-hybrid curves such as X25519MLKEM768) on inbound connections

Use cases include:

• regulated / compliance-driven environments that mandate explicit TLS parameter control
• environments preparing for post-quantum transition where PQ KEM is one part of a larger profile
• clusters where the admission webhook should expose a predictable, auditable TLS configuration aligned with platform TLS security profiles (for example OpenShift APIServer TLS profiles)

Today there is no first-class configuration for these profile fields on SPIRE Controller Manager TLS listeners.

Proposed direction

Introduce a top-level YAML block (working name: tlsProfile) in ControllerManagerConfig, with fields such as:

tlsProfile:
  minTLSVersion: VersionTLS13
  cipherSuites:
    - TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
    - TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384
  curvePreferences:
    - X25519MLKEM768
    - X25519
    - secp256r1