security/ldapauth: support dynamic certificate rotation for LDAP authentication

**Is your feature request related to a problem? Please describe.**

The certificates used for LDAP authentication (domain CA certificate, client TLS certificate, and client TLS key) are configured via cluster settings. While these settings can be updated at runtime via `SET CLUSTER SETTING`, this approach has several security limitations:

1. **No automatic rotation**: Certificates can expire or be compromised, but there is no mechanism for automatic file-based rotation (unlike CockroachDB's own node certificates which support file-based hot-reloading).
2. **Operational burden**: Rotating certificates requires SQL-level access to execute `SET CLUSTER SETTING`, which may not align with security teams' certificate management workflows (e.g., cert-manager, HashiCorp Vault, or other PKI infrastructure).
3. **Sensitive material in KV**: Certificate PEM content (including private keys for mTLS) is stored as plaintext strings in the `system.settings` table, making it visible in backups, debug zips, and potentially logs.
4. **No expiry monitoring**: There is no built-in mechanism to warn operators when LDAP certificates are approaching expiry, increasing the risk of authentication outages.

**Describe the solution you'd like**

Support a more secure and operationally friendly certificate management mechanism for LDAP authentication that enables automatic rotation without requiring SQL-level access, and avoids storing sensitive key material directly in KV.

**Describe alternatives you've considered**

Open for discussion — the right approach likely depends on how CockroachDB wants to handle certificate lifecycle management more broadly (e.g., file-based hot-reload, integration with external secret stores, or improvements to the existing cluster settings approach).

Jira issue: CRDB-64859

Epic CRDB-54682