Making Pilot agent cert locations configurable

Hi! I’d like to start work on https://github.com/istio/istio/issues/11984. As per the contribution guidelines I’m opening up the discussion here. Any thoughts? This seems fairly straightforward (the default certs location will not change)