Add Support to for providing TLS certificates for Ingress listeners from an SDS source

[banks]

This builds on #10613.

This PR adds a new low-level feature for Ingress Gateways. It allows operators to specify an external Envoy SDS (Secret Discovery Service) Service and allows loading TLS certificates for listeners.

The PR commits logically work through each package/area that needed updates with relevant tests so may be a cleaner way to view the diff.

Documentation still to-do but the intended usage is as shown in the integration test:

1. Operator registers the Ingress service with one or more custom static cluster sin bootstrap using the Proxy.Config.envoy_extra_static_clusters_json configuration. This static cluster specifies how to connect to the SDS service(s) and takes care of authenticating the ingress to that SDS service however the SDS integration requires.
2. The operator can then use new config fields in the ingress-gateway Config Entry to specify which SDS certificate resource names to load (from which clusters) for the whole gateway, each listener or per service.

TODO Before

This is ready for review as it is I think as the code is all here. There are several additional bits that I will either do in this PR or a follow up before this is released:

• Changelog entry
• api package updates for Config Entry

TODO In later PR

• Document the new options in Ingress Gateway Config Entry
• Document how to use SDS end-to-end (as an "Advanced Topic")
  • I don't think we need a Learn guide here because this is low-level only really needed for folks that want to build a custom integration with an SDS service. We will later provide an opinionated way to do this that will hide all these details from end-users.

[banks]

TODO:

• This causes conflicts in Ent tests because it means that the default ns service web has a route named web in OSS but default/default/web in Ent. causing all golden files to conflict. This probably needs to follow the same logic structs.Upstream.Identifier which omits default values to keep the identifiers consistent between OSS and Ent. Shame we can't easily re-use that method from here with the types available.

[banks]

Fixed in later commit.

[hashicorp-cla]

All committers have signed the CLA.

[banks]

Updated with fixes from Enterprise version.

[rboyer]

LGTM

[hc-github-team-consul-core]

🍒 If backport labels were added before merging, cherry-picking will start automatically.

To retroactively trigger a backport after merging, add backport labels and re-run https://circleci.com/gh/hashicorp/consul/455247.