Support rotation of System WellKnownCACertificates in BTLSP

[guydc]

Description:
Currently, BTLSP System WellKnownCACertificates are not reloaded by envoy on change.

https://github.com/envoyproxy/gateway/blob/main/internal/xds/translator/translator.go#L985

According to envoy docs:

If trusted_ca is a filesystem path, a watch will be added to the parent directory for any file moves to support rotation. This currently only applies to dynamic secrets, when the CertificateValidationContext is delivered via SDS.

https://www.envoyproxy.io/docs/envoy/latest/api-v3/extensions/transport_sockets/tls/v3/common.proto#envoy-v3-api-msg-extensions-transport-sockets-tls-v3-certificatevalidationcontext

See additional discussion here: envoyproxy/envoy#10387

Envoy Gateway can deliver the file source validation context using SDS, ensuring that changes in the CA certificate are picked-up by Envoy.

[optional Relevant Links:]

Any extra documentation required to understand the issue.