Support custom CA certificates in EnvoyExtensionPolicySpec

*Description*:
>Describe the desired behavior, what scenario it enables and how it
would be used.

Consider the following EnvoyExtensionPolicy. I have configured the extension to get loaded via HTTP from a Service hosted in-cluster. However, I cannot configure custom CA certificates because the Pod(s) hosting the extension receive cluster-internal certificates issued via cert-manager.
I currently have to use HTTP, which is rather insecure.

If I use an cluster-external service, I need to use publicly trusted certificates.

Injecting the CA certificate into the gateway pod itself seems overkill and defeats the self-service methodology the Gateway API follows.

It would be great to be able to reference a ConfigMap or Secret (best would be both!) and a key in the Map to configure trusted CA certificates. Bonus points when we can add multiple CA certificates from different secrets for zero-downtime migrations.

```yaml
apiVersion: gateway.envoyproxy.io/v1alpha1
kind: EnvoyExtensionPolicy
metadata:
name: my-plugin
spec:
targetRefs:
- group: gateway.networking.k8s.io
kind: Gateway
name: my-gateway
wasm:
- name: wasm-filter
code:
type: HTTP
http:
url: http://my-provider.my-namespace.svc.cluster.local/plugin.wasm
sha256: 98ea6e4f216f2fb4b69fff9b3a44842c38686ca685f3f55dc48c5d3fb1107be4
```

[optional *Relevant Links*:]
>Any extra documentation required to understand the issue.

Related to #5619