CKA Scenario 5 - Force nginx to TLS 1.3 with a ConfigMap edit + rolling restart (CKA Workloads)

To force nginx to use TLS 1.3, edit the ConfigMap to restrict ssl_protocols to TLS 1.3 only, then roll the Deployment with kubectl rollout restart. This is because ssl_protocols is an allow list and nginx only reads it when it starts. Editing the ConfigMap alone is not enough.