safekeeper: add enable_tls_wall_service_api

[DimasKovas]

Problem

Safekeeper doesn't use TLS in wall service

• Closes: https://github.com/neondatabase/cloud/issues/27302

Summary of changes

• Add enable_tls_wall_service_api option to safekeeper's cmd arguments
• Propagate tls_server_config to wall_service if the option is enabled
• Create BACKGROUND_RUNTIME for small background tasks and offload SSL certificate reloader to it.

No integration tests for now because support from compute side is required: https://github.com/neondatabase/cloud/issues/25823

[Copilot]

Copilot reviewed 5 out of 5 changed files in this pull request and generated no comments.

[github-actions]

8232 tests run: 7794 passed, 0 failed, 438 skipped (full report)

---

Flaky tests (6)

Postgres 17

• test_pageserver_gc_compaction_preempt: release-arm64-without-lfc
• test_isolation[v1-4]: release-x86-64-without-lfc
• test_create_churn_during_restart: release-arm64-without-lfc

Postgres 16

• test_create_churn_during_restart: release-x86-64-with-lfc

Postgres 15

• test_sliding_working_set_approximation: release-arm64-with-lfc

Postgres 14

• test_get_tenant_size_with_multiple_branches: release-x86-64-with-lfc

Code coverage* (full report)

• functions: 33.2% (8942 of 26969 functions)
• lines: 48.8% (77113 of 157861 lines)

* collected from Rust tests only

---

_{The comment gets automatically updated with the latest test results
37bd82a at 2025-04-11T14:33:32.995Z :recycle:}

[Copilot]

Copilot reviewed 5 out of 5 changed files in this pull request and generated no comments.

Comments suppressed due to low confidence (1)

safekeeper/tests/walproposer_sim/safekeeper.rs:188

• Consider adding tests for behavior when enable_tls_wall_service_api is enabled to ensure new TLS functionality is exercised.

        enable_tls_wall_service_api: false,