[EV-6485] fix(istio): set correct CA_TRUSTED_NODE_ACCOUNTS namespace on OpenShift

[electricjesus]

Summary

• The embedded Istio Helm chart's OpenShift platform profile hardcodes trustedZtunnelNamespace: "kube-system", but the operator deploys ztunnel to calico-system
• This causes istiod to set CA_TRUSTED_NODE_ACCOUNTS=kube-system/ztunnel, so it rejects all ztunnel impersonation requests with "request impersonation authentication failure"
• Workloads in the ambient mesh cannot obtain SPIFFE certificates, causing connection resets (curl exit code 56) on all mesh traffic
• Fix: explicitly set trustedZtunnelNamespace in the istiod Helm values to IstioNamespace (calico-system), overriding the OpenShift profile default

Changes

• pkg/render/istio/config.go: Add TrustedZtunnelNamespace field to IstiodOpts struct
• pkg/render/istio/istio.go: Set TrustedZtunnelNamespace: IstioNamespace in istiod chart values
• pkg/render/istio/istio_test.go: Update OpenShift test assertion from kube-system/ztunnel to calico-system/ztunnel

Release Note

Set correct CA_TRUSTED_NODE_ACCOUNTS namespace on OpenShift

Fixes: https://tigera.atlassian.net/browse/EV-6485

Test plan

• CI render tests pass (updated assertion)
• Deploy on OpenShift cluster and verify CA_TRUSTED_NODE_ACCOUNTS=calico-system/ztunnel on istiod
• Verify ztunnel can obtain SPIFFE certs (no impersonation errors in istiod logs)
• Verify ambient mesh traffic flows (curl between pods returns 200)
• Run DE journey test: istio-ambient-mode traffic encryption and Calico network policy enforcement