Allow to specify TLS CAs outside of -pd-cluster-secret

Feature Request

Is your feature request related to a problem? Please describe:
We use tidb-operator to run TiKV cluster w/o TiDB layer. Our clients are deployed to a separate k8s cluster. It is not safe to share private key of root CA, so our clients have a separate root CA. Now I have to provider PD/TiKV with combined ca.crt from client and server. We rely on cert-manager.io to generate and rotate certificates as recommended on https://docs.pingcap.com/tidb-in-kubernetes/stable/enable-tls-between-components#using-cert-manager, but it does not allow to add an additional ca.crt in the generated secrets.

Describe the feature you'd like:
Allow to specify a separate secret for root CA to override ca.crt from -pd-cluster-secret. Or allow security/cacert-path to take precedence of secrete instead of blindly overriding it in https://github.com/pingcap/tidb-operator/blob/62b11ad37ddd3482dfec519770d6c65011e24d6d/pkg/manager/member/pd_member_manager.go#L836-L841 so that it is possible to mount and configure it separately

Describe alternatives you've considered:

• Use security/cacert-path in CR, but it is gets overridden by -pd-cluster-secret mount.
• Use additionalVolumeMount in CR with subPath to mount a different ca.crt under /var/lib/pd-tls, but k8s forbids mounting to the same path
• Add client root CA to /etc/ssl/certs/ca-certificates.crt on the pod (system trust store), but PD and TiKV doesn't seem honoring it.
• Put combined ca.crt into secret for the cert-manager.io Issuer, but cert-mahager.io Certificate does not include it in the generated certificate secrete.
  The only alternative I can see is not using cert-manager.io, but generate secrete manually, however then I will have to implement in infrastructure to rotate certificates.

Teachability, Documentation, Adoption, Migration Strategy:

Start at pkg/manager/member/pd_member_manager.go around lines 836-841 and trace how -pd-cluster-secret mounts ca.crt and how security/cacert-path is handled in the CR. Review the PD/TiKV TLS configuration described in the issue. Done means a separate root-CA secret or a working precedence path can be configured without overriding the intended CA.