Upstream 2071 - Add postgres_extra_settings for postgresql.conf overrides

[blaipr]

Upstream PR: ansible/awx-operator#2071

SUMMARY

Adds a postgres_extra_settings field to the AWX CRD. When set, the operator renders a ConfigMap of postgresql.conf overrides and mounts it into the managed postgres pod:

spec:
  postgres_extra_settings:
    - setting: max_connections
      value: "499"
    - setting: ssl_ciphers
      value: "HIGH:!aNULL:!MD5"

This supersedes postgres_extra_args, which upstream marks deprecated in the same change. That variable exists in this fork too, so the deprecation note applies as written.

Every template hunk is gated on postgres_extra_settings | length > 0, so with the field unset the rendered StatefulSet is unchanged.

ADDITIONAL INFORMATION

This one needed real adaptation rather than a clean cherry-pick, so the deviations from upstream are worth stating up front.

Task layout. Upstream applies the ConfigMap in roles/installer/tasks/database.yml. This fork has no such file — upstream split it out after the fork point, and its contents are still inside database_configuration.yml here (the two files' tails are identical). I placed the task at the equivalent point: immediately after Set database as managed, which is where upstream's ordering puts it relative to the surrounding tasks, and well before the statefulset that mounts the ConfigMap is applied.

Dropped from the upstream hunk. The conflicting hunk in statefulsets/postgres.yaml.j2 bundled two things belonging to other upstream changes:

• postgres_annotations (from #1829) — not ported to this fork, and postgres_annotations is not defined in roles/installer/defaults/main.yml. Taking it verbatim would have put an undefined variable into the postgres StatefulSet template for every managed-database deploy.
• checksum-secret-postgres_configuration_secret — unrelated to this feature.

I kept only the checksum-postgres_extra_settings annotation this feature needs, and wrapped annotations: inside the same conditional so an empty annotations: key isn't emitted when the field is unset.

Also dropped: upstream's .gitignore entry for hacking/ and dev/awx-cr/awx-db-configuration.cr.yml — this fork has no dev/ directory.

Verified rather than assumed: the ConfigMap mounts at /opt/app-root/src/postgresql-cfg, which is the sclorg config include directory, and this fork's _postgres_image is quay.io/sclorg/postgresql-15-c9s, so the path is right. The new template's ../common/templates/labels/common.yaml.j2 lookup is the same one the existing configmaps/config.yaml.j2 uses.

Not verified: I have no cluster to deploy this against, so it is untested beyond reading. The CRD parses.

The docs hunk lands in docs/user-guide/database-configuration.md, which #17 also touches, so one of the two will need a rebase.

ISSUE TYPE

• New or Enhanced Feature

COMPONENT NAME

• API (AWX CRD), installer role, Docs