ceph/rgw: add s3.ceph.unkin.net to radosgw cert SAN + nginx aliases (#487)

## Why

`s3.ceph.unkin.net` is the RGW S3 endpoint name used by cephrgw-operator consumers. A companion argocd-apps PR adds it as a CNAME to `radosgw.service.consul`. The radosgw hosts front RGW with nginx (443 -> radosgw:7480) using the vault-issued cert, so **both** the certificate and nginx must recognise the name.

## Changes (hieradata/roles/infra/ceph/rgw.yaml)

- Add `s3.ceph.unkin.net` to `profiles::pki::vault::alt_names` — puts the name in the radosgw cert SAN (renewal re-triggers on the alt-names change).
- Add `s3.ceph.unkin.net` to `profiles::nginx::simpleproxy::nginx_aliases` — nginx answers for that server_name.

### nginx: yes, needed

radosgw sits behind `profiles::nginx::simpleproxy` (listens 443, proxies to :7480) sharing the same vault cert, so the alias is required for nginx to serve the hostname — not just the cert SAN.

---------

Co-authored-by: benvin <neotheo@gmail.com>
Reviewed-on: #487
Co-authored-by: Ben Vincent <ben@unkin.net>
Co-committed-by: Ben Vincent <ben@unkin.net>

hieradata/roles/infra/ceph/rgw.yaml

@@ -14,6 +14,9 @@ profiles::pki::vault::alt_names:
   - radosgw.service.consul
   - radosgw.query.consul
   - "radosgw.service.%{facts.country}-%{facts.region}.consul"
+  # S3 endpoint name (s3.ceph.unkin.net CNAME -> radosgw.service.consul); needed
+  # on the cert so TLS validates for that hostname.
+  - s3.ceph.unkin.net
 
 # additional repos
 profiles::yum::global::repos:
@@ -26,6 +29,8 @@ profiles::yum::global::repos:
 profiles::nginx::simpleproxy::nginx_vhost: 'radosgw.service.consul'
 profiles::nginx::simpleproxy::nginx_aliases:
   - radosgw.service.au-syd1.consul
+  # nginx (443 -> radosgw:7480) must answer for the S3 endpoint name too.
+  - s3.ceph.unkin.net
 profiles::nginx::simpleproxy::proxy_port: 7480
 profiles::nginx::simpleproxy::proxy_path: '/'
 nginx::client_max_body_size: 5000M