changefeedccl: allow certificate path in changefeed URL

**Is your feature request related to a problem? Please describe.**

1. Expired certificates require the recreation of changefeeds.
2. Setting up certs in the first place requires serialization and other UX failure modes. See also https://github.com/cockroachdb/cockroach/issues/82408

**Describe the solution you'd like**

Allow reference to a certificate path in a changefeed URL, instead of the literal certificate/CA. Users could swap out certificates in the file system and expect things to continue smoothly, without having to alter or recreate a changefeed.

`cockroach start` uses [`--certs-dir`](https://www.cockroachlabs.com/docs/stable/cockroach-start#security). Can we learn from that UX?

@HonoreDB mentions that we’d need to ensure that the updated certs are distributed to all nodes. True. I note that customers are already managing certificates for CRDB itself, so I don’t think it would be burdensome.

It is an open question as to what the refresh behavior should be.
- Eager, with a file watcher
- Passive but smart, where a cert failure triggers an attempt to reload the cert from the filesystem
- Some sort of syntax or API to allow the operator to reload

Jira issue: CRDB-30115

Epic CRDB-9040