SDS: support listener certificates

[zirain]

Question: Why are SDS Secrets only supported for backend TLS? It seems reasonable to also support them for listener certificates, since Envoy can fetch listener certs via SDS.

Originally posted by @zhaohuabing in #8983 (comment)

[hooiv]

I’d like to work on this feature. I plan to trace the existing backend TLS SDS path and listener certificate translation, then add listener-certificate SDS support using the existing Secret/SDS configuration model where possible. I’ll add translator/XDS regression coverage, update user-facing docs and a release-note fragment, and avoid API changes unless the existing API cannot express the feature. Please let me know if anyone is already working on this or if the maintainers prefer a different design.

[zirain]

@hooiv thanks for moving this forward.