Bind the Gateway TLS secret to Konnect via KongCertificate/KongSNI

Gateway API's listeners[].tls.certificateRefs never gets synced to
Konnect by the gateway operator in this setup — same working pattern
as every other resource here (KongService, KongRoute, ...): a
Kong-native CRD, not the Gateway API's own translation.

kong/rest/certificate.yaml

@@ -0,0 +1,23 @@
+apiVersion: configuration.konghq.com/v1alpha1
+kind: KongCertificate
+metadata:
+  name: ${NAME}
+  namespace: ${NAMESPACE}
+spec:
+  controlPlaneRef:
+    type: konnectNamespacedRef
+    konnectNamespacedRef:
+      name: ${CONTROL_PLANE_REF_NAME}
+  type: secretRef
+  secretRef:
+    name: ${NAME}-tls
+---
+apiVersion: configuration.konghq.com/v1alpha1
+kind: KongSNI
+metadata:
+  name: ${NAME}
+  namespace: ${NAMESPACE}
+spec:
+  name: ${REST_HOSTNAME}
+  certificateRef:
+    name: ${NAME}