Non-disruptive certificate rotation

*Description*:
Currently, we have MTLS connections for:
- Envoy Gateway <> Envoy
- Envoy <> Rate Limit server

Envoy Gateway generates client and server certificates for all of the above components and typically provides them as mounted secrets to relevant pods. A job that runs in the helm pre-install and pre-upgrade hooks is responsible for rotation.

It is a common security practice to use short-lived certificates that are rotated frequently. In Envoy Gateway, CA certificates and leaf certificates are handled with the same level of security (storage, access, ... ), and should both be rotated.

To support frequent and non-disruptive rotation, the following is required:
- All components are capable of dynamically reloading certificates when they change.
- Certificates are rotated in a backwards-compatible manner. For example, a new trusted CA is added and the old CA is removed only after all components were able to load the latest CA/leaf certificate. This is especially relevant for data-plane components like Rate Limit where client-facing failures may occur if Envoy and Rate Limit are not both synchronized on the latests CA/leaf certificates.

Currently, these requirements are not met:
- Dynamic reloading:
- Envoy Gateway supports re-reading the TLS Key, Cert and CA Cert for each connection: https://github.com/envoyproxy/gateway/blob/23856723c58df0ad28e128481f558bce41078700/internal/crypto/cert_load.go#L54
- Envoy supports dynamic reload of TLS Key, Cert and CA Cert through the SDS path-based reference to mounted secrets: https://github.com/envoyproxy/gateway/blob/23856723c58df0ad28e128481f558bce41078700/internal/infrastructure/common/proxy_sds.go#L10
- Rate Limit supports dynamic reload of TLS Key/Cert but not CA: https://github.com/envoyproxy/ratelimit/blob/6a2e8262874f012d08830cc34ba8058e66a33819/src/provider/cert_provider.go#L15
- Backwards compatible changes: Envoy Gateway currently overwrites certificates in-place, meaning the change is not backwards-compatible. https://github.com/envoyproxy/gateway/blob/23856723c58df0ad28e128481f558bce41078700/internal/cmd/certgen.go#L81

[optional *Relevant Links*:]
>Any extra documentation required to understand the issue.