design: Split deployments user experience improvements

[youngnick]

Issue #881 covers an initial phase of work to secure communication between Contour and Envoy, allowing for a more secure split deployment. This issue covers the second phase of a three-phase plan to make secure split deployments the default for Contour.

The ultimate outcome of the plan is:

• Split deployments the default for Contour
• Secure communication between Contour and Envoy via secured gRPC.
• Authentication for Envoy such that Contour can ensure that only its Envoy can see secret information (like Ingress or IngressRoute certificates), without Envoy needing to access the Kubernetes apiserver.

This design should cover adding additional functionality and/or tools to Contour to help with making the certificate management problem for mutual TLS certificates for gRPC easier.

It will probably include something like:

• support for initial generation of a CA keypair, a Contour keypair, and an Envoy keypair, and the creation of Kube Secrets for the same (excepting the CA key). It may use the Kube apiserver CA functionality, but that will need to be carefully designed to avoid compromising the Authentication goal.
• Tooling to help with rotating some or all of those keypairs.
• A set of deployment YAMLs that don't need extra openssl or similar commands run locally.

[youngnick]

Turns out that work on #862 effectively designed this without the need for a design doc. Closing in favour of #1215 for implementation.