reworked restart/update-cert path to always trigger update before restart

[PietroPasotti]

Issue

Fixes #265

Solution

Reworked the restart_grafana method to always call _update_cert if CertHandler.enabled.
Together with a unified _cert_ready method that verifies that the cert and key files are on the container filesystem, this should ensure a (more) robust flow:

1. if certhandler is enabled:
2. push cert and key files
3. build the grafana layer
4. If cert and key files are present on the workload filesystem, configure grafana accordingly

To test:
charmcraft pack

deploy this bundle

bundle: kubernetes
applications:
  ca:
    charm: self-signed-certificates
    channel: edge
    revision: 40
    scale: 1
    constraints: arch=amd64
  external-ca:
    charm: self-signed-certificates
    channel: edge
    revision: 40
    scale: 1
    constraints: arch=amd64
  prom:
    charm: prometheus-k8s
    channel: edge
    revision: 152
    series: focal
    resources:
      prometheus-image: 130
    scale: 1
    constraints: arch=amd64
    storage:
      database: kubernetes,1,1024M
    trust: true
  trfk:
    charm: traefik-k8s
    series: focal
    scale: 1
    constraints: arch=amd64
    storage:
      configurations: kubernetes,1,1024M
    trust: true
relations:
- - prom:ingress
  - trfk:ingress-per-unit
- - trfk:certificates
  - external-ca:certificates
- - prom:certificates
  - ca:certificates
- - trfk:receive-ca-cert
  - ca:send-ca-cert

Then deploy grafana:

juju deploy ./grafana-k8s.charm --resource grafana-image=docker.io/ubuntu/grafana:9.2-22.04_beta --resource litestream-image=docker.io/litestream/litestream:0.4.0-beta.2

Once all is active/idle, do a jhack imatrix fill to cross-relate

[PietroPasotti]

depends on canonical/grafana-rock#19