Allow users to customize the CA of impersonation proxy to use with ingress

Is your feature request related to a problem? Please describe.

Currently, we cannot use the impersonation proxy with an ingress controller and a custom DNS name. Here is my use case:

I have an Ingress with the host impersonation-proxy.example.com, and a wildcard certificate for *.example.com signed by a Certificate Authority. The Ingress is pointing to the service pinniped-concierge-proxy. Then here is my CredentialIssuer.

apiVersion: config.concierge.pinniped.dev/v1alpha1
kind: CredentialIssuer
metadata:
    name: using-custom-certificates
spec:
  impersonationProxy:
    # Enable the proxy
    mode: enabled
    # Provision a service
    service:
      type: ClusterIP
    # Advertise an external DNS name that points at a custom ingress
    externalEndpoint: impersonation-proxy.example.com

With this configuration, pinniped get kubeconfig complains that the certificate is signed by an unknown authority. I believe this is because the TLS endpoint in the concierge pod on port 8444 is served with an internal generated certificate.

Describe the solution you'd like

So I need something like:

apiVersion: config.concierge.pinniped.dev/v1alpha1
kind: CredentialIssuer
metadata:
    name: using-custom-certificates
spec:
  impersonationProxy:
    # Enable the proxy
    mode: enabled
    # Provision a service
    service:
      type: ClusterIP
    # Advertise an external DNS name that points at a custom ingress
    externalEndpoint: impersonation-proxy.example.com
    tls:
      # Point to some certificate/key to serve with, this would be my wildcard certificate for `*.example.com`.
      secretName: my-tls-cert

Or we could allow serving concierge in a non-TLS port, because the internal traffic between the ingress controller and the concierge could be non-TLS, with something like:

apiVersion: config.concierge.pinniped.dev/v1alpha1
kind: CredentialIssuer
metadata:
    name: using-custom-certificates
spec:
  impersonationProxy:
    # Enable the proxy
    mode: enabled
    # Provision a service
    service:
      type: ClusterIP
    tls:
      # Disable TLS
      enabled: false

This is already discussed in https://github.com/vmware-tanzu/pinniped/issues/617 (last use case) and https://github.com/vmware-tanzu/pinniped/issues/363#issuecomment-905710186.

Start by tracing the CredentialIssuer impersonationProxy configuration and the concierge pod's generated TLS certificate behavior. Read the prior discussion in issues 617 and 363, then define and validate one supported approach for custom CA or TLS settings that makes the ingress use case work without an unknown-authority error.