clickhouse: expose new backup.endpointCA field from cozystack values schema #18

Upstream cozystack adds a new nested field to the ClickHouse app's values schema: backup.endpointCA ({name, key}), which points the clickhouse-backup sidecar at a Secret holding a PEM CA bundle so it can verify an S3 endpoint whose certificate is signed by a private CA (Cozystack's in-cluster SeaweedFS being the motivating case).

Upstream PR: cozystack/cozystack#3385

Because this provider hand-maintains a Terraform schema plus an expand/flatten pair per Kind — with no codegen from values.schema.json — the new field is not surfaced until it is added here. Per the upstream trigger map in docs/agents/contributing.md, "add, remove or rename a field in an app's values.schema.json" reaches the schema, the model, and the expand/flatten pair.

Scope for clickhouse:

• add endpoint_ca (or the naming this provider prefers) as a nested block under backup, with name and key attributes;
• key defaults to ca.crt upstream — note the provider restates defaults on Optional+Computed attributes and therefore sends its own default, so a stale or missing default silently wins over the API's;
• extend the expand/flatten pair and the hand-vendored field-name copies in the tests.

Filing as an issue rather than a PR because the right moment is presumably alongside the next api/apps/v1alpha1 pin bump, which is a maintainer call rather than mine.