fix: use internal frontend in GetPublicClientAddress when enabled

[ujala-singh]

Implements 957

Summary

• The GetPublicClientAddress method was always returning the frontend service address regardless of whether internal frontend was enabled.
• This caused authentication issues for internal operations like creating the default namespace when auth was configured on the public frontend.

Validation

2025-09-01T06:55:20Z	INFO	Starting reconciliation	{"controller": "temporalnamespace", "controllerGroup": "temporal.io", "controllerKind": "TemporalNamespace", "TemporalNamespace": {"name":"default","namespace":"temporal"}, "namespace": "temporal", "name": "default", "reconcileID": "38d32796-6ead-41a1-adb0-e60f629eb8dd"}
2025-09-01T06:55:20Z	DEBUG	Connecting to temporal cluster	{"controller": "temporalnamespace", "controllerGroup": "temporal.io", "controllerKind": "TemporalNamespace", "TemporalNamespace": {"name":"default","namespace":"temporal"}, "namespace": "temporal", "name": "default", "reconcileID": "38d32796-6ead-41a1-adb0-e60f629eb8dd", "address": "temporal-cluster-internal-frontend-headless.temporal:7236"}
2025-09-01T06:55:20Z	INFO	Successfully reconciled namespace	{"controller": "temporalnamespace", "controllerGroup": "temporal.io", "controllerKind": "TemporalNamespace", "TemporalNamespace": {"name":"default","namespace":"temporal"}, "namespace": "temporal", "name": "default", "reconcileID": "38d32796-6ead-41a1-adb0-e60f629eb8dd", "namespace": "default"}

[alexandrevilain]

Thanks @ujala-singh !

Looks like it breaks mTLS e2e tests :)

[sonarqubecloud]

Quality Gate passed

Issues
1 New issue
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[ujala-singh]

@alexandrevilain I have fixed it, it can use frontend only if TLS is enabled. Reference

I have updated the code accordingly as it will use frontend only if mTLS is enabled.

[nishantmunjal7]

@alexandrevilain are we good with this, can we merge ?