Mount certs when using clients even with external servers

[t-eckert]

Changes proposed in this PR:

• Mount autoencrypt certs when using clients
• Fix changelog

How I've tested this PR:

• BATS

How I expect reviewers to test this PR:

• BATS

Checklist:

• Tests added
• CHANGELOG entry added

  HashiCorp engineers only, community PRs should not add a changelog entry.
  Entries should use present tense (e.g. Add support for...)

[t-eckert]

This fix is repeated in 3 spots. It allows the use of certs to talk to local clients when connected to an external server like HCP.

[andrewstucki]

Update: this is added only here in order to have an auto-encrypt-based cert mounted to establish proper client-node communication if clients are explicitly enabled (in which case our controller still leverages the agent node) -- otherwise we'll try and use the system roots to verify a connection to the client node with a cert provisioned through the auto-encrypt process and the TLS handshake will fail.

[curtbushko]

Approving so that we can get it in the release for tomorrow

[t-eckert]

@andrewstucki I will be watching this to see if there are any issues. If you don't see any, feel free to do the merge.

[andrewstucki]

@ishustava Looks like the enterprise-control-plane tests are failing, not sure if that's flaky or something just currently broken in main, here's the error:

[DEBUG] freeport: Test "TestRun_WithProvider" returned ports [13009 13010 13011 13012 13013 13014 13015 13016]
    command_test.go:264: assertions.go:262: 
        	Error Trace:	command_test.go:272
        	            				retry.go:148
        	            				retry.go:149
        	            				retry.go:103
        	            				command_test.go:264
        	Error:      	Received unexpected error:
        	            	Unexpected response code: 500 (internal error: CA provider is nil)

but other than that I think this is probably good to go with the smaller-scoped change given the earlier discussion. Let me know if there are any other concerns that you have and thanks again for reviewing.

[ishustava]

@andrewstucki looks like this one is a flake. It should be safe to re-run, and if it passes, we're good.