Please address the comments from this code review:

## Overall Comments
- MinVersion() and CipherSuites() re-read and re-parse the environment settings on every call; if these are used in hot paths, consider resolving and caching the effective values once (e.g., via sync.Once) to avoid repeated work and ensure consistency across calls.
- parseMinVersion currently hardcodes the list of accepted versions in the error message; consider deriving the allowed values from supportedVersions to keep the error message in sync if you add more versions in the future.

## Individual Comments

### Comment 1
<location> `pkg/tlsprofile/profile.go:51-27` </location>
<code_context>
+// TLS_CHACHA20_POLY1305_SHA256) are always enabled and not configurable.
+// This setting only affects the TLS 1.2 cipher negotiation.
+func CipherSuites() []uint16 {
+	envValue := env.TLSCipherSuites.Setting()
+	if envValue == "" {
+		return defaultCipherSuites
+	}
</code_context>

<issue_to_address>
**suggestion:** Consider trimming whitespace when deciding whether TLS cipher suites are configured

A value like `ROX_TLS_CIPHER_SUITES="  "` is currently treated as configured and passed to `parseCipherSuites`, which fails with `no valid cipher suites in input`, logs a warning, and falls back to defaults. Trimming whitespace before the empty-string check (e.g. `envValue := strings.TrimSpace(env.TLSCipherSuites.Setting())`) would make blank values behave like unset ones and avoid unnecessary warnings.

Suggested implementation:

```golang
	envValue := strings.TrimSpace(env.TLSCipherSuites.Setting())

```

You will also need to:
1. Ensure `strings` is imported at the top of `pkg/tlsprofile/profile.go`:
   - Add `strings` to the existing import block, e.g. `import ("strings" ... )`, or extend the current import list accordingly.
2. Confirm that there are no other references to `envValue` in `CipherSuites()` that assume it contains untrimmed content. The rest of the logic can remain unchanged because `parseCipherSuites` should already handle non-empty values as before.
</issue_to_address>