Connect: Unnecessary Intermediates returned with leaf

See gist: https://gist.github.com/i0rek/1da69d6fb57a731b7e07a46330ab1296

The first is the output from fetching a leaf on a secondary DC using consul provider right after initial bootstrap - it contains the leaf and 2 other certs but should only have one other - the signing cert. Figure out why there are two.

The second response is after a primary root rotation - now there are 4 certs but one of them is repeated twice. We expect there to be 3 now - the leaf, the current intermediate and the cross signed intermediate. I'm not yet sure which is duplicated.

Figure out what these certs are and why duplication happens.

All tests pass so this isn't breaking anything but is a bug that we are returning more than we need and might mask a bigger issue somewhere.