fix: ensure consistent etcd certificate permissions on first etcd node (#13367)

* fix(etcd): ensure consistent certificate permissions on first etcd node

The etcd certificate generation script runs on the first etcd node and
creates certs with default ownership and permissions. Subsequent copy
tasks set explicit ownership and permissions on the remaining etcd
nodes, resulting in inconsistent permissions across the cluster.

This can cause issues such as etcd backup jobs failing on the first
node due to missing read access to certificate files.

Add an ansible.builtin.file task after cert generation to explicitly
set the correct ownership and permissions on the first etcd node.

* fix(etcd): guard client certificate permissions

* fix(etcd): set certificate permissions during installation

roles/etcd/templates/make-ssl-etcd.sh.j2

@@ -101,5 +101,5 @@ if [ -e "$SSLDIR/ca-key.pem" ]; then
 fi
 
 if [ -n "$(ls -A *.pem)" ]; then
-    mv *.pem ${SSLDIR}/
+    install -o {{ etcd_owner | quote }} -g {{ etcd_cert_group | quote }} -m 0640 -- *.pem "${SSLDIR}/"
 fi