fix(kuma-cp) use EnvoyGRPC to fix DNS resolving

[jakubdyszkiewicz]

Summary

Use EnvoyGRPC instead of GoogleGRPC for XDS so it fixes #1620
The cost of this fix is that now the dataplane token is visible in config dump. It's not that bad since we don't expose config_dump ourselves.
You need to explicitly ssh into host to fetch it and Envoy admin binds only to localhost.

We may switch back to GoogleGRPC once the bug with DNS resolving is fixed.

Full changelog

• Pass Dataplane Token instead of Dataplane Token Path for Bootstrap request. This way we detect that we should use EnvoyGRPC. If dataplane token path is send then it means we still use GoogleGRPC.
  This has to be done for backwards compatibility.
• Pass CA to BootstrapRequest that was passed to the kuma-dp. Previously we were just using cert of dp server and it somehow worked for GoogleGRPC whether it was CA or not.
  EnvoyGRPC requires real CA, therefore we use CA (trusted_ca.inline_bytes) that was passed to kuma-dp run if possible. If not we are trying to use DP server cert which is most likely selfsigned cert (is CA).
  If it is not a CA we throw an error.

Issues resolved

Fix #1620

Documentation

• No docs, internal changes

[subnetmarco]

This is okay because the config dump cannot be performed without SSH access to the machine, correct? @jakubdyszkiewicz

[lobkovilya]

I think errors could not parse certificate should be better wrapped somewhere up the stack trace. If these are validation errors then I believe it makes sense to mention the field .CaCert

[lobkovilya]

I'd better change it to

func validateCA(cert []byte) error {
...
}

and if it's not CA then return NotCA straight away.

It will simplify the usage of this method:

func (b *bootstrapGenerator) validateCaCert(cert []byte, request types.BootstrapRequest) error {
	if request.DataplaneTokenPath != "" {
		// when using GoogleGRPC it is valid to put non-CA certificate therefore we should only verify this for EnvoyGRPC
		// EnvoyGRPC is used when DataplaneToken is passed via request as inline value, not as a file.
		return nil
	}

	return validateCA(cert)
}

And probably, in that case, we don't need a separate validateCA method, I guess its content can be inlined

[jakubdyszkiewicz]

This is okay because the config dump cannot be performed without SSH access to the machine, correct? @jakubdyszkiewicz

@subnetmarco correct