feat: shared tls secret for default https listener

[zachsmith1]

• adding a capability to use a shared wildcard tls cert for the default https-listener
• made it optional through config
• an operator would create this tls secret and then propagate it with something like karmada and/or kyverno so that it landed in every downstream namespace (ns-*)

Ref: datum-cloud/enhancements#622

[cla-assistant]

All committers have signed the CLA.

[cla-assistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}