Nomad should accept multiple CA for tls encryption

Consul has the ability to accept multiple CA. Nomad having similar behaviour for TLS should be able to do the same.

More specifically:

- `NOMAD_CAPATH` should be acepted as an environment variable to replace `NOMAD_CACERT` but pointing to a directory with multiple CA instead of a single CA file
- `tls.ca_path` should be accepted in the configuration to replace `tls.ca_file` that points to a directory instead of a single certificate file

This can allow graceful migration when the previous CA is nearing its end of life by having a period in time where the old and new CA could be both accepted.

This is similar to https://github.com/hashicorp/nomad/issues/4295 although this issue is about the nomad certificates in nomad, not the consul client in nomad.

Start by locating the existing handling for NOMAD_CACERT and tls.ca_file in Nomad's TLS configuration and environment-variable entry points. Compare the related Consul behavior referenced in issue 4295. Done means NOMAD_CAPATH and tls.ca_path accept a CA directory while preserving single-file support for graceful CA migration.

Written by the indexing model from the issue text.