Reload tls_client_ca_file on SIGHUP

Is your feature request related to a problem? Please describe.
Bootstrapping vault.

• Start vault with temporary dummy certificates.
• Generate real certificates with vault.
• Replace temporary certificates at the same path.
• Reload.

Describe the solution you'd like
Reload the file at tls_client_ca_file like tls_cert_file and tls_key_file.

Describe alternatives you've considered
Full restart + unseal

Additional context
For tls_cert_file/tls_key_file there's some conflicting docs:
"SIGHUP will not reload your TLS configuration."
"On SIGHUP, the path set here at Vault startup will be used for reloading the certificate"

From a robot:

     Empirically confirmed, with a double dissociation:

     1. Baseline: real PKI client cert → 200.
     2. Replaced only the on-disk tls_client_ca_file with a rogue CA (verified on disk), sent SIGHUP — Vault logged Vault reload triggered.
     3. Real PKI cert (trusted only by the in-memory CA now) → still 200. If the file had been reloaded, this must fail.
     4. Rogue cert (trusted only by the on-disk file) → rejected, server logged failed to verify certificate. If the file had been reloaded, this must succeed.
     5. Restored the real CA, reloaded, 200 again.

     So SIGHUP reloads the server cert/key but not tls_client_ca_file

Search the Go code for SIGHUP handling and the tls_client_ca_file setting, then compare that reload path with tls_cert_file and tls_key_file. Reproduce the reported certificate swap and verify that SIGHUP causes the client CA file to be reread, while preserving the documented certificate reload behavior.