registry: avoid storing full tls certificates

[ptrus]

Currently we store whole certificates in registry, during #2475 an idea came up that we could potentially only store certificate hashes:

...But I guess the ony way to avoid it would be to completely override how TLS authentication is performed so that only certificate hashes would be compared ...

Taken from: #2475 (comment)

Should probably at least evaluate the approach.

[kostko]

With google.golang.org/grpc/security/advancedtls (see #2822) being a thing, this should be easy to do.

[kostko]

Instead of comparing certificate hashes we could just verify Ed25519 public keys. This would also simplify configuring certificates via the CLI/config as a public key is small compared to a certificate.