Proposal: move Connect CA implementation to a new package

The [Consul Connect CA](https://www.consul.io/docs/connect/ca) is a sub-system that is responsible for managing a Certificate Authority for the service mesh and auto-config. Currently it is implemented across a number of packages and files:
* `agent/consul/connect_ca_endpoint.go`
* `agent/consul/leader_connect_ca.go`
* `agent/consul/server_connect.go`
* `agent/cache-types/connect_ca_leaf.go`
* `agent/consul/state/connect_ca.go`
* `agent/connect/ca`

This issue proposes we restructure this sub-system to make it easier to test, and easier to develop.

The proposed structure is:
* `agent/connect/ca` - the "core logic" of the system, currently in `agent/consul/leader_connect_ca.go`, and the state store functions from `agent/consul/state/connect_ca.go`
* `agent/connect/ca/carpc` - the RPC server, currently in `agent/consul/connect_ca_endpoint.go`
* `agent/connect/ca/caprovider` - the providers, currently in `agent/connect/ca`
* `agent/connect/ca/caleafs` - the client implementation for generating leaf certs, currently in `agent/cache-types/connect_ca_leaf.go`

Start by reading the current implementations in agent/consul/connect_ca_endpoint.go, agent/consul/leader_connect_ca.go, agent/consul/server_connect.go, agent/cache-types/connect_ca_leaf.go, agent/consul/state/connect_ca.go, and agent/connect/ca. Map each responsibility to the proposed ca, carpc, caprovider, and caleafs packages, then verify the existing CA behavior remains intact after the restructure.

Written by the indexing model from the issue text.