Dynamic certificate reloading for Terminating Gateways

#### Feature Description

Terminating Gateways can be configured with certificates for TLS origination to destination services.

These certificates are currently loaded from disk, and the path they are loaded from is not watched for changes. This means that is the certificates for any service are rotated, then Envoy needs to be restarted to pick them back up.

To avoid downtime, after a key/cert rotation users need to do a rolling restart or an Envoy [hot-restart](https://blog.envoyproxy.io/envoy-hot-restart-1d16b14555b5). Ideally neither of these would be required.

This could be achieved by specifying these key/cert files via the Envoy SDS API ([Relevant Envoy PR](https://github.com/envoyproxy/envoy/pull/10163)). Envoy will subscribe to filesystem changed to resources watched by SDS, and update dynamically.

Note: it seems the watch will only trigger if there is an atomic symlink swap, not if individual files are updated. That would need to be documented.

Start by reviewing the Envoy SDS API and the linked Envoy PR, then trace how Consul configures certificate files for Terminating Gateways. Done means rotated certificates are picked up without an Envoy restart, and the atomic symlink-swap requirement is documented; the payload names no Consul files or tests.

Written by the indexing model from the issue text.