Add spec.tls field to UpstreamOIDCProvider API.

This allows for a custom CA bundle to be used when connecting to the upstream issuer.

Signed-off-by: Matt Moyer <moyerm@vmware.com>

deploy/supervisor/idp.supervisor.pinniped.dev_upstreamoidcproviders.yaml

@@ -98,6 +98,15 @@ spec:
                 minLength: 1
                 pattern: ^https://
                 type: string
+              tls:
+                description: TLS configuration for discovery/JWKS requests to the
+                  issuer.
+                properties:
+                  certificateAuthorityData:
+                    description: X.509 Certificate Authority (base64-encoded PEM bundle).
+                      If omitted, a default set of system roots will be trusted.
+                    type: string
+                type: object
             required:
             - client
             - issuer