grafana: Configure Loki datastore

Usually, Grafana datastores are configured using its web GUI.  When
setting up a datastore that requires TLS client authentication, the
client certificate and private key have to be pasted into the form.
For certificates that renew frequently, this method would require a
frequent manual effort.  Fortunately, Grafana supports defining
datastores via its "provisioning" mechanism, reading the configuration
from YAML files on the filesystem.

grafana/loki-cert.yaml

@@ -0,0 +1,12 @@
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: loki-client-cert
+spec:
+  commonName: grafana
+  privateKey:
+    algorithm: Ed25519
+  secretName: loki-client-cert
+  issuerRef:
+    name: loki-ca
+    kind: ClusterIssuer