Bind the Gateway TLS secret to Konnect via KongCertificate/KongSNI

Gateway API's listeners[].tls.certificateRefs never gets synced to
Konnect by the gateway operator in this setup — same working pattern
as every other resource here (KongService, KongRoute, ...): a
Kong-native CRD, not the Gateway API's own translation.

kong/kustomization.yaml

@@ -2,6 +2,7 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
   - rest/service.yaml
+  - rest/certificate.yaml
   - rest/routes.yaml
   - rest/path-rewrite.yaml
   - rest/path-rewrite-bindings.yaml