feat: update CA trust bundle for kubecost containers

[takirala]

What problem does this PR solve?:

• Kubecost Update: Bumps Kubecost to version 2.5.2 to incorporate the new update-ca-trust init container from the latest chart. This enables the attached cluster's Kubecost to communicate with the management cluster's COSI bucket using a custom CA.
• Entrypoint Renaming: Renames the velero-ceph entrypoint to external-ceph. This is purely a metadata change and does not affect functionality (e.g., ports remain unchanged).
• Ingress Migration: Moves the velero-ceph ingress definition from the Velero app to the Ceph app. This ensures the ingress is deployed whenever Ceph is deployed, aligning with its use by both the Velero CLI and Kubecost agents. Deploying it from the Ceph app avoids redundancy and simplifies management. Additionally, since the rename changes the ingress name, upgrades will not encounter naming conflicts.
• Image Overrides: Removes some image overrides in the Kubecost definition to use the upstream chart's recommended defaults.
• COSI Driver Relocation: Moves the Ceph COSI driver from the Kubecost definition to the Ceph app. Ceph-agnostic COSI resources remain in the Kubecost definition.

Which issue(s) does this PR fix?:

https://jira.nutanix.com/browse/NCN-104938

Special notes for your reviewer:

Does this PR introduce a user-facing change?:

Checklist

• If the PR adds a version bump, ensure there is no breaking change in Licensing model (or NA).
• If a chart is changed or app configuration is significantly changed, the chart version is correctly incremented (so that apps are not automatically upgraded from a previous version of DKP).

[github-actions]

✅ Created Kommander branch to test kommander-applications changes: https://github.com/mesosphere/kommander/tree/kapps/main/tga/kubecost-use-custom-ca

[coveralls]

Pull Request Test Coverage Report for Build 12754563307

Warning: This coverage report may be inaccurate.

This pull request's base commit is no longer the HEAD commit of its target branch. This means it includes changes from outside the original pull request, including, potentially, unrelated coverage changes.

• For more information on this, see Tracking coverage changes with pull request builds.
• To avoid this issue with future PRs, see these Recommended CI Configurations.
• For a quick fix, rebase this PR at GitHub. Your next report should be accurate.

Details

• 0 of 0 changed or added relevant lines in 0 files are covered.
• No unchanged relevant lines lost coverage.
• Overall coverage remained the same at 51.703%

---

Totals
Change from base Build 12702082266:	0.0%
Covered Lines:	167
Relevant Lines:	323

---

💛 - Coveralls