feat(tls): make central TLS opt-out by default

[jkhelil]

Changes

Make EnableCentralTLSConfig opt-out (default: enabled)

EnableCentralTLSConfig was a plain bool (opt-in, default false), meaning every
OpenShift cluster had to explicitly set it to true before any TLS profile injection
kicked in — defeating the point of a cluster-wide security policy.

This PR changes the field type to *bool and defaults it to true via SetDefaults:

• New installs: central TLS active out of the box.
• Upgrades: existing CRs that omit the field deserialize to nil; SetDefaults
  sets nil → true on the next reconcile, so TLS injection is transparently enabled.
• Opt-out: operators who need to manage TLS manually can set
  enableCentralTLSConfig: false in their TektonConfig CR.

ResolveCentralTLSToEnvVars and GetPlatformData are updated to treat nil as
enabled; only an explicit false suppresses injection.

Submitter Checklist

• Run make test lint before submitting a PR
• Includes tests (if functionality changed/added)
• Includes docs (if user facing)
• Commit messages follow commit message best practices

Release Notes

Central TLS configuration is now enabled by default on OpenShift. The `enableCentralTLSConfig`
field in `TektonConfig` has changed from an opt-in bool to an opt-out *bool: existing clusters
will automatically inherit the cluster APIServer TLS profile (minimum version, cipher suites)
on the next reconcile after upgrade. Set `enableCentralTLSConfig: false` to opt out.

Made with Cursor

[tekton-robot]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
To complete the pull request process, please ask for approval from jkhelil after the PR has been reviewed.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[jkhelil]

/retest

[jkhelil]

/kind feature