Find a way to make TLS required

Currently, if `tlsRef` is not provided, TLS is not enabled. I don't think anybody should be deploying without TLS, even if it's just a self-signed certificate. Options to consider: 1. Just error out (ideally, on the webhook level) if the TLS secret is not provided. This is a bit nuclear but also the simplest path. 2. Use cert-manager to generate a self-signed certificate. If cert-manager is not available, either fail or go to 3. 3. Generate a self-signed certificate locally. This is not a great option since it may be quite hard to refresh the certificate generated this way (cert-manager does it for free). Same thing needs to be done with MariaDB. Let's start with researching what other established operators (prometheus, postgresql, etc) are doing in this area. /kind enhancement /help