fix(consoleplugin): translate IANA ciphers to OpenSSL for nginx

[jkhelil]

Summary

• Resolves tls-scanner TC08 finding: pipelines-console-plugin nginx was not honoring the cluster cipher suite (Intermediate profile) — api_server_tls_config_compliance.ciphers=false
• Adds ianaToOpenSSLCiphers() to translate IANA cipher suite names (from the OpenShift APIServer TLS profile) to the OpenSSL names required by nginx's ssl_ciphers directive
• The mapping is derived by inverting library-go's openSSLToIANACiphersMap — the canonical source of truth for OpenShift profile ciphers
• TLS 1.3 ciphers (TLS_AES_*, TLS_CHACHA20_*) are intentionally skipped: nginx/OpenSSL negotiates them automatically when TLSv1.3 is in ssl_protocols
• ssl_prefer_server_ciphers on; is emitted alongside ssl_ciphers so the cluster-defined ordering is respected

Context

Part of the central TLS management work (SRVKP-9632). The console plugin already:

• fetches the APIServer TLS profile dynamically
• applies ssl_protocols and ML-KEM PQC groups (ssl_conf_command Groups X25519MLKEM768:X25519)

This PR adds the missing ssl_ciphers piece.

Behaviour when APIServer cipher list is nil

When no explicit tlsSecurityProfile is set on APIServer/cluster, the operator receives a nil cipher list and writes no ssl_ciphers directive. Nginx then falls back to its built-in default (HIGH:!aNULL:!MD5), which on RHEL/OpenSSL 3.x expands to ~131 cipher suites — far broader than any OpenShift TLS profile.

This is intentional and consistent with all other Pipelines components: propagate what the APIServer provides, never invent a fallback cipher list. Production OpenShift clusters always carry an explicit TLS profile (the platform default is Intermediate, confirmed by library-go: DefaultTLSProfileType = TLSProfileIntermediateType). A cluster with no profile set is misconfigured from a compliance standpoint — the operator should not silently mask that.

To reproduce real production conditions, explicitly set the Intermediate profile:

oc patch apiserver cluster --type=merge \
  -p '{"spec":{"tlsSecurityProfile":{"type":"Intermediate","intermediate":{}}}}'

Cluster validation evidence

APIServer set to Intermediate profile. The nginx ConfigMap is generated with exactly the 6 TLS 1.2 Intermediate ciphers:

ssl_protocols TLSv1.2 TLSv1.3;
ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305;
ssl_prefer_server_ciphers on;
ssl_conf_command Groups X25519MLKEM768:X25519;

Live TLS handshake tests:

Test	Result
TLS 1.2 + ECDHE-RSA-AES128-GCM-SHA256 (Intermediate cipher)	✅ Negotiated
TLS 1.2 + AES256-SHA (Old-profile-only cipher)	✅ Rejected (handshake failure, Cipher: NONE)

Test plan

• Deploy operator to an OCP cluster with Intermediate profile explicitly set
• Confirm nginx.conf contains the Intermediate cipher set from the API server
• Verify Intermediate ciphers are accepted and non-profile ciphers are rejected
• Run tls-scanner and confirm TC08 passes

Relates-To: SRVKP-9632

[jkhelil]

/release-note-none

[jkhelil]

/hold

[jkhelil]

/unhold

[jkhelil]

/unhold

[jkhelil]

/hold

[jkhelil]

/unhold

[jkhelil]

/hold

[jkhelil]

/unhold

[tekton-robot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: pramodbindal

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [pramodbindal]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[pratap0007]

LGTM

[pratap0007]

/lgtm

[jkhelil]

/cherry-pick release-v0.80.x

[tekton-robot]

✅ Cherry-pick to release-v0.80.x successful!

A new pull request has been created to cherry-pick this change to release-v0.80.x.

PR: #3655

Please review and merge the cherry-pick PR.