Add support for automatically synchronizing the Fleet Server's CA certificate to Elastic Agents deployed on external Kubernetes clusters (not managed by ECK)

**Describe the enhancement:**

Add support for automatically synchronizing the Fleet Server's CA certificate to Elastic Agents deployed on external Kubernetes clusters (not managed by ECK). This would allow Agents to trust the Fleet Server without manual intervention when the CA is rotated by ECK.

**Describe a specific use case for the enhancement or feature:**

- **User Scenario**: A user deploys Elasticsearch, Kibana, and Fleet Server on cluster A using ECK. They then deploy Elastic Agents on cluster B (external to ECK) using the manifests provided by Kibana's Fleet UI. The Fleet Server's CA is auto-rotated by ECK every year, but the Agents on cluster B cannot automatically update their trust store. This forces the user to manually update the CA across all external clusters, which is error-prone and time-consuming.
- **Impact**: This breaks the promise of ECK handling certificates automatically and adds operational overhead, especially in multi-cluster or hybrid environments.

**What is the definition of done?**

ECK manages certificates automatically for multi-cluster setups, including renewal.

I'm no expert on the matter but maybe Elastic Agents can support a mechanism to automatically fetch and update their CA trust store from the secret containing Fleet Server's CA (e.g., via a sidecar container, init container, or direct API call to the Fleet Server) ? Anyway, the implementation is open to discussion.

I may be missing something, although I did not find a documentation on how to configure Elastic Agents certificates when using ECK.

Edit : Maybe using a service mesh to connect both Elastic Agents and Fleet Server could be an alternative ? If anyone can confirm that.

Start by reviewing the deployment manifests provided by Kibana's Fleet UI and how ECK exposes the Fleet Server CA secret to external clusters. Define the supported synchronization mechanism and verify that external Elastic Agents update their trust store automatically after the Fleet Server CA rotates.

Written by the indexing model from the issue text.