backups: a CNPG restore takes the credentials Secret, key names and CA from the strategy as it is now #5279

Describe the bug

A CNPG restore takes the destination path and the endpoint URL of the source from the Backup artifact's driverMetadata, but the credentials Secret, its key names and the endpoint CA from the CNPG strategy as it reads at restore time. The artifact already records the Secret it was written with (cnpg.io/s3-secret-ref), yet nothing on the restore path reads it, and the key names and the CA are not recorded at all.

If the strategy changed its credentials Secret, its accessKeyIDKey / secretAccessKeyKey, or its endpointCA after the backup was taken, the restore combines the recorded endpoint with access settings meant for another location. Recovery then fails after an in-place restore has already purged the target Cluster.

Environment

• Cozystack main (the restore path predates fix(postgres): stop backup jobs from fighting over the WAL archive destination #5221, which made the artifact record the destination it was actually written to)
• Any provider

To Reproduce

1. Back up a Postgres application with a CNPG strategy whose barmanObjectStore uses credentials Secret A and endpoint CA A.
2. Change the strategy to Secret B, other key names, or CA B, for instance after moving the bucket to another endpoint.
3. Restore the application in place from the backup taken in step 1.

Expected behaviour

The restore reaches the archive with the access settings it was written with: the recorded Secret, and key names and CA recorded alongside it, falling back to the strategy only for artifacts that carry no record.

Actual behaviour

The restore patches the application with the recorded path and endpoint but the strategy's current Secret, key names and CA, so barman-cloud cannot authenticate or verify TLS against the source archive.

Logs

Not applicable: the behaviour follows from which fields the restore path reads.

Screenshots

Not applicable.

Additional context

Recording the key names and the CA reference next to the destination (#5221 records the destination on the cnpg.io/Backup and copies it into the artifact) and reading cnpg.io/s3-secret-ref on restore would close it. It changes what the restore trusts from the artifact, which a tenant cannot edit, so it is worth its own change rather than a follow-up commit. Raised by an automated review on #5221.

Checklist

• I have checked the documentation
• I have searched for similar issues
• I have included all required information
• I have provided clear steps to reproduce
• I have included relevant logs