S3 tls cert

[PietroPasotti]

Issue

sthe s3 interface may give to the coordinator a "tls-ca-chain" that the worker is expected to use when using the provisioned storage bucket.
At the moment we are not doing anything with it, which means Worker charms can't use storage that is behind tls

Also there is a bad assumption within the coordinator's s3 config, that the "endpoint" we receive via the s3 integration has a scheme prefix. We use that to determine whether insecure=True.
Not only insecure=False will not work given we don't give the worker a tls cert for the storage configuration, but also it turns out the s3 interface doesn't always give us a full url, but could also give us a fqdn (i.e. no scheme).

Solution

add a field to the cluster schema
coordinator puts there the cert if present in s3 databag, worker picks it up and puts it to filesystem
coordinator uses the cert's presence to determine if insecure=true instead of the endpoint scheme.

Context

too much to tell

Testing Instructions

added some unittests
we should try to deploy tempo HA with this lib, configure s3 to use a certificate, relate and see if it works.

[sed-i]

Need to remember to release and bump coordinators' cos-lib.