`gwa apply` should support Certificate resources

Certificates (required for mTLS and custom domains) must be loaded with `gwa pg` - there is no support in `apply`. As a result, teams who want to add certs need to use `gwa pg` for all their gateway config and then `apply` for other resources. `apply` should be a one-stop shop.

Certificates and SNIs (being Kong objects) should probably follow the way GatewayConfig is handled (declarative, replacement of existing resources). I think - confirm how to approach this!

AC
- `gwa apply` supports `kind: Certificate` alongside other resources and gateway config.

Start by tracing the `gwa apply` command and compare its resource handling with `gwa pg` and the existing GatewayConfig path. Confirm how Certificate and SNI Kong objects should be represented and whether they use declarative replacement. Done means `gwa apply` accepts `kind: Certificate` alongside other resources and gateway config, with coverage for the supported behavior.

Written by the indexing model from the issue text.