Feature request: Let's Encrypt for Vault itself

**Is your feature request related to a problem? Please describe.**

In case Vault is secured end-to-end with self signed certificates (which seems to be the most common way of deploying it), anyone who is going to access to Vault needs to have the CA pubkey to verify the authenticity of the certificate & avoid MiTM attacks.

This requires to have a method to provision this CA in a secure way, which is not completely trivial. It can be done by putting it in a place where it is already trusted/verified like the company website: `https://mycompany.com/ca.pem`.

**Describe the solution you'd like**

Ideally I would like to avoid the people administrating Vault the hassle of trusting this CA. I don't know if it's even possible but here it is my proposal:

* Extenal load balancer (1.2.3.4:8200)
* Vault address listening to this external load balancer: `listener "tcp" { address "1.2.3.4:8200" }`. `api_addr` & `cluster_addr` would use internal kubernetes pod ip addresses.
* Vault also serving TLS in this address `listener "tcp" { tls_{cert,key}_file "/cert/from/letsencrypt-acme.{cert,key}" }`
* Use `cert-manager` and add support for automatic retrieval&renewal

**Describe alternatives you've considered**

Providing a custom CA cert out of band.

Start by reviewing the Vault Helm chart's listener configuration and how api_addr and cluster_addr are rendered. Check whether cert-manager can provide and renew the proposed Let's Encrypt certificate at the external load balancer, and consider the work complete when external TLS works without distributing a custom CA while internal addresses remain usable.

Written by the indexing model from the issue text.