Source per-domain Gateway TLS certs from Vault instead of cert-manager

cert-manager-issued Certificates never synced to Konnect as KongCertificate
objects through the Gateway API listener path, so dataplanes fell back to
Kong's default self-signed cert. Reuse the working kong-namespace pattern
(a static wildcard cert) via ExternalSecret instead.

dataplane-template/externalsecret-tls.yaml

@@ -0,0 +1,23 @@
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: ${NAME}-tls
+  namespace: ${NAMESPACE}
+spec:
+  refreshInterval: 1h
+  secretStoreRef:
+    kind: ClusterSecretStore
+    name: vault-kong-v2
+  target:
+    name: ${NAME}-tls
+    template:
+      type: kubernetes.io/tls
+  data:
+    - secretKey: tls.crt
+      remoteRef:
+        key: kong-v2/shared/tls/sttlab-local
+        property: tls.crt
+    - secretKey: tls.key
+      remoteRef:
+        key: kong-v2/shared/tls/sttlab-local
+        property: tls.key