feat(redis): add digital signature to leaf cert usages for ECDSA TLS handshake

TLS_ECDHE_ECDSA cipher suites require the server certificate to assert the
digital signature key usage so the server can sign ephemeral key-exchange
parameters. Without it, strict TLS clients reject the handshake even though
the cert is otherwise valid. Added the usage to the leaf Certificate and
extended the helm-unittest suite to cover it.

Assisted-By: Claude <noreply@anthropic.com>
Signed-off-by: Arsolitt <arsolitt@gmail.com>

packages/apps/redis/templates/certmanager.yaml

@@ -69,6 +69,7 @@ spec:
   renewBefore: 720h
   isCA: false
   usages:
+    - digital signature
     - server auth
     - client auth
     - key encipherment

packages/apps/redis/tests/tls_test.yaml

@@ -125,6 +125,9 @@ tests:
       - equal:
           path: spec.privateKey.algorithm
           value: ECDSA
+      - equal:
+          path: spec.privateKey.size
+          value: 256
 
   - it: "third document is the CA Issuer when TLS enabled via external"
     templates:
@@ -175,6 +178,26 @@ tests:
           path: spec.privateKey.algorithm
           value: ECDSA
 
+  - it: "leaf Certificate usages include digital signature for ECDSA TLS handshake"
+    templates:
+      - templates/certmanager.yaml
+    set:
+      external: true
+    documentIndex: 3
+    asserts:
+      - contains:
+          path: spec.usages
+          content: "digital signature"
+      - contains:
+          path: spec.usages
+          content: "server auth"
+      - contains:
+          path: spec.usages
+          content: "client auth"
+      - contains:
+          path: spec.usages
+          content: "key encipherment"
+
   - it: "leaf Certificate SAN list covers all four redis-operator service names with all DNS variants"
     templates:
       - templates/certmanager.yaml