Add optional root CA signature verification for client, server and management certificates

[Damans227]

Description

The root-ca plugin never checked that certificates were actually signed by the CloudStack root CA. checkClientTrusted() checked revocation, validity and SAN, but not the signature. checkServerTrusted() did nothing at all, so any server certificate was trusted. isManagementCertificate() trusted any cert with the right SAN, signed or not.

This adds the missing signature check to all three, checked against every CA in the configured chain (so CA rotation still works). It's controlled by a new config key, ca.plugin.root.ca.signature.verification, off by default so upgrades are a no-op.

For checkClientTrusted/checkServerTrusted, this follows the same pattern as the plugin's other checks: it only actually rejects a bad cert when ca.plugin.root.auth.strictness is also true. Otherwise it just logs. isManagementCertificate always enforces it once enabled, since it's not part of that strict/non-strict handshake logic.

Types of changes

• Enhancement (improves an existing feature and functionality)

Feature/Enhancement Scale or Bug Severity

Feature/Enhancement Scale

• Minor

How Has This Been Tested?

Added unit tests for valid certs, certs signed by a rogue CA, certs signed by a non-primary CA in a rotated chain, and the no-CA-available case, in both strict and non-strict mode, across all three checks.

How did you try to break this feature and the system with this change?

Checked the flag defaults to off so nothing changes for existing deployments. Checked a cert signed by a different CA gets rejected once both flags are on. Checked CA rotation still works. Checked the missing-CA case doesn't throw an unhandled exception mid-handshake.

[codecov]

Codecov Report

❌ Patch coverage is 89.06250% with 7 lines in your changes missing coverage. Please review.
✅ Project coverage is 19.65%. Comparing base (4f11707) to head (6a0d895).

Files with missing lines	Patch %	Lines
...oudstack/ca/provider/RootCACustomTrustManager.java	84.78%	2 Missing and 5 partials ⚠️

Additional details and impacted files

@@ Coverage Diff @@## main #13787 +/- ##
=========================================
Coverage 19.65% 19.65% - Complexity 19792 19808 +16 
=========================================
Files 6368 6368 Lines 574881 574942 +61 Branches 70351 70368 +17 =========================================
+ Hits 112970 113029 +59 + Misses 449639 449635 -4 - Partials 12272 12278 +6 

Flag	Coverage Δ
uitests	3.41% <ø> (ø)
unittests	20.93% <89.06%> (+<0.01%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.