DefaultCertValidator includes only the first CA cert in the digest for TLS session ID generation

*Title*: *DefaultCertValidator includes only the first CA cert in the digest for TLS session ID generation*

*Description*:
In [DefaultCertValidator::updateDigestForSessionId](https://github.com/envoyproxy/envoy/blob/329dd5106e758b7b24a65af51b8a28e3a0568af5/source/common/tls/cert_validator/default_validator.cc#L533-L541), `ca_cert_` is included in computing the hash for session id generation. If the `trusted_ca` contains more than one CA certs, changes of any CA certs other than the first one won't invalidate the TLS session id.

Because `ca_cert_` is [assigned exactly once](https://github.com/envoyproxy/envoy/blob/329dd5106e758b7b24a65af51b8a28e3a0568af5/source/common/tls/cert_validator/default_validator.cc#L160-L163), to the first item->x509 encountered in the parsed CA-cert PEM bundle.

Start in source/common/tls/cert_validator/default_validator.cc at DefaultCertValidator::updateDigestForSessionId and the ca_cert_ assignment around lines 160-163. Trace how the trusted_ca PEM bundle is parsed, then inspect the relevant TLS certificate-validator tests. Done means changes to any certificate in a multi-CA bundle affect the TLS session ID digest, with regression coverage for that case.

Written by the indexing model from the issue text.