Update Velero to handle custom CA, fix NP and upgrade bugs

Package MRs:

• https://repo1.dso.mil/platform-one/big-bang/apps/cluster-utilities/velero/-/merge_requests/4
• https://repo1.dso.mil/platform-one/big-bang/apps/cluster-utilities/velero/-/merge_requests/9
• https://repo1.dso.mil/platform-one/big-bang/apps/cluster-utilities/velero/-/merge_requests/10

Adds handling of CA certs as a secret, volume mounting, and setting proper envs. Note that this only supports Azure and AWS right now, but that is also the extent of our plugin support.

Also fixes some bugs with upgrade jobs and NPs.

Closes https://repo1.dso.mil/platform-one/big-bang/bigbang/-/issues/329

/cc @LynnStill @michaelmcleroy @ryan.j.garcia

This is an urgent fix for bugs found in 1.10 upgrade testing, along with a fix for a bug that we have been identifying as a known issue in every release. Will need to be cherrypicked in 1.10

chart/values.yaml

@@ -96,6 +96,10 @@ flux:
 networkPolicies:
   # -- Toggle all package NetworkPolicies, can disable specific packages with `package.networkPolicies.enabled`
   enabled: true
+  # -- Control Plane CIDR, defaults to 0.0.0.0/0, use `kubectl cluster-info` to get the right value
+  # Must be an IP CIDR range (x.x.x.x/x - ideally with /32 for the specific IP)
+  # Used by package NetworkPolicies to allow Kube API access
+  controlPlaneCidr: 0.0.0.0/0
 
 # ----------------------------------------------------------------------------------------------------------------------
 # Istio
@@ -908,7 +912,7 @@ addons:
     git:
       repo: https://repo1.dso.mil/platform-one/big-bang/apps/cluster-utilities/velero.git
       path: "./chart"
-      tag: "2.21.1-bb.1"
+      tag: "2.21.1-bb.4"
 
     # -- Flux reconciliation overrides specifically for the Velero Package
     flux: {}