[mTLS] Default RootCA for Client Certificates

@nitishm Thanks for the update! Gateway has nothing to do with Citadel. I was trying to type Citadel agent, which is Gateway agent in the ingress SDS deployment. A controller that converts the secret is a good idea!