feat(cloudnativePG): support topologySpreadConstraints

A HA `Cluster` is only actually highly available if its instances end up in different failure domains. Pod
anti-affinity alone cannot express that: it only keeps the instances off the same node, not off the same zone,
and `cloudnativePG.affinity` has no way to encode a skew budget. Without `topologySpreadConstraints` a three
instance cluster can legitimately be scheduled into a single availability zone, where a zone outage takes down
the primary and both replicas at once.

Both `affinity` and `topologySpreadConstraints` are rendered only when they are set. The CloudNativePG API
declares them as `omitempty`, so an empty `{}` or `[]` in the manifest would show up as a permanent diff against
the state the operator writes back.

Tolerations deliberately do not get a dedicated value. CloudNativePG has no `spec.tolerations`, it nests them
below `spec.affinity.tolerations`, so they are configured through `cloudnativePG.affinity` like `nodeSelector`
and the anti-affinity settings. A separate top-level value would only have to be folded back into the same place
and would silently conflict with a tolerations list set via `cloudnativePG.affinity`.

Co-authored-by: Copilot <copilot@github.com>

unittests/helm/cluster/basics.yaml

@@ -45,6 +45,10 @@ tests:
           path: spec.storage.storageClass
       - notExists:
           path: spec.walStorage
+      - notExists:
+          path: spec.affinity
+      - notExists:
+          path: spec.topologySpreadConstraints
 
   - it: "Render the credential Secret with the default values"
     template: templates/secret_cloudnativePG.yaml
@@ -129,3 +133,50 @@ tests:
           value:
             size: "42Mi"
             storageClass: "my-wal-storage-class"
+
+  - it: "Apply the scheduling customizations"
+    template: templates/cluster.yaml
+    set:
+      cloudnativePG:
+        enabled: true
+        affinity:
+          nodeSelector:
+            disktype: ssd
+          podAntiAffinityType: required
+          tolerations:
+            - key: my-key
+              operator: Equal
+              value: my-value
+              effect: NoSchedule
+        priorityClassName: my-priority-class
+        topologySpreadConstraints:
+          - maxSkew: 1
+            topologyKey: topology.kubernetes.io/zone
+            whenUnsatisfiable: DoNotSchedule
+            labelSelector:
+              matchLabels:
+                app.kubernetes.io/name: gitea
+    asserts:
+      - equal:
+          path: spec.affinity
+          value:
+            nodeSelector:
+              disktype: ssd
+            podAntiAffinityType: required
+            tolerations:
+              - key: my-key
+                operator: Equal
+                value: my-value
+                effect: NoSchedule
+      - equal:
+          path: spec.priorityClassName
+          value: my-priority-class
+      - equal:
+          path: spec.topologySpreadConstraints
+          value:
+            - maxSkew: 1
+              topologyKey: topology.kubernetes.io/zone
+              whenUnsatisfiable: DoNotSchedule
+              labelSelector:
+                matchLabels:
+                  app.kubernetes.io/name: gitea