MariaDB: model the new tls field (upstream cozystack#2680) #40

cozystack/cozystack#2680 adds a tls object to packages/apps/mariadb/values.schema.json:

tls:
  issuer: string     # enum: operator | cert-manager, default operator
  required: bool     # no default, absent means plaintext is still accepted

The provider models tls for postgres, kafka, nats and qdrant but not for mariadb, so a cozystack_mariadb resource cannot set it.

Two things differ from those four. There is no enabled: TLS is always served by mariadb-operator, and issuer only selects who issues the server certificate, so omit the block to follow external does not apply here. required carries no schema default on purpose; model it optional with no Default: so the API applies the chart's behaviour, since a provider-sent false would still be a write the chart treats as explicit.

issuer wants stringvalidator.OneOf("operator", "cert-manager").