Remove Need for SANs in Provided Cert/Key Pair

[alecmerdler]

Issue: https://issues.redhat.com/browse/PROJQUAY-1737

Changelog: Remove the need for SANs of internal k8s service hosts in provided cert/key pair for Quay.

Docs: quay/quay-docs#157

Testing: There are a few different situations which must be tested:

Route	SERVER_HOSTNAME	Custom cert/key pair	Expected result
Managed	None	None	Uses generated Route hostname, self-signed certs
Managed	None	Provided (for generated Route hostname)	Uses generated Route hostname and provided certs
Managed	None	Provided (for random hostname)	Blocked rollout, error in status.conditions
Managed	registry.company.com	Provided (invalid)	Blocked rollout, error in status.conditions
Managed	registry.company.com	None	Uses provided hostname and self-signed certs
Managed	registry.company.com	Provided (valid)	Uses provided hostname and certs
Unmanaged	None	None	Error because SERVER_HOSTNAME is unset
Unmanaged	None	Provided (for random hostname)	Error because SERVER_HOSTNAME is unset
Unmanaged	registry.company.com	None	Uses provided hostname and self-signed certs
Unmanaged	registry.company.com	Provided (invalid)	Blocked rollout, error in status.conditions
Unmanaged	registry.company.com	Provided (valid)	Uses provided hostname and provided certs

Details: Most public key infrastructure cannot generate cert/key pairs for the internal Kubernetes Service hostnames (quay.namespace.svc). Previously, the Operator would reject provided certs which did not include these hostnames as Subject Alternative Names (SANs) because they were believed to be needed for TLS connections within the cluster. This is not the case, so this check is removed.

To use a Route with the included OpenShift cluster cert/key pair, mark the route component as managed: false, include SERVER_HOSTNAME as the future generated Route hostname (follows the pattern <route-name>-<namespace>.apps.<cluster>), then create your own Route which points to the Quay app Service and uses re-encrypt TLS termination, with the destinationCACertificate set to the generated tls.cert found in the Secret mounted into the Quay app pods.