Use tls-certificates v3

[sed-i]

Issue

Certificates generated by the charm don't include intermediates: canonical/httprequest-lego-k8s-operator#93.

Solution

This was addressed by canonical/tls-certificates-interface#141 in v3, but wasn't back-ported to v2, so bump to v3.

Technically the diff presents a breaking change for the .chain property, but we haven't really used it anywhere yet.

In tandem with:

• Use entire chain for the server cert traefik-k8s-operator#317

Upgrade notes

Due to this diff:

-if chain := self._peer_relation.data[self.charm.unit].get("chain", []):
+if chain := self._peer_relation.data[self.charm.unit].get("chain", ""):

on charm upgrade, the new charm would be expecting a str, but peer data would hold a List[str]. For this reason, first unrelate (tls_certificates), upgrade, and then relate again.

[Abuelodelanada]

Shouldn't we use TLSCertificatesRequiresV3 in cert_handler v1 too?

[sed-i]

Shouldn't we use TLSCertificatesRequiresV3 in cert_handler v1 too?

I didn't bump cert_handler, it's still at v0.