Add support for Dual CA in Octavia

[Gregory Thiemonge]

Originally reported in https://bugzilla.redhat.com/show_bug.cgi?id=1828247

When Octavia is deployed with Tripleo, it uses a single CA for all communications between Octavia's services and amphorae: the CA is used by the services to authenticate the amphora and it is used by the amphorae to authenticate the services.

To improve security, upstream documentation recommends the use of two CA:
- one to authenticate amphorae from the services
- one to authenticate clients (services) in the amphorae.

Upstream doc: https://docs.openstack.org/octavia/latest/admin/guides/certificates.html

Note that a customer using a single CA should be able to update OSP to a release that supports dual CA without losing control of the existing amphorae.
The following etherpad explains how to achieve it: https://etherpad.opendev.org/p/octavia-single-ca-to-multi-ca

[OpenStack Infra (hudson-openstack)]

Related fix proposed to branch: master
Review: https://review.opendev.org/723536

[OpenStack Infra (hudson-openstack)]

Related fix proposed to branch: master
Review: https://review.opendev.org/723539

[Marios Andreou (marios-b)]

Bug status has been set to 'Incomplete' and target milestone has been removed due to inactivity. If you disagree please re-set these values and reach out to us on freenode #tripleo

[OpenStack Infra (hudson-openstack)]

Change abandoned by "James Slagle <email address hidden>" on branch: master
Review: https://review.opendev.org/c/openstack/tripleo-ansible/+/716518
Reason: Abandoning this patch per the TripleO Patch Abandonment guidelines
(https://specs.openstack.org/openstack/tripleo-specs/specs/policy/patch-abandonment.html).
If you wish to have this restored and cannot do so yourself, please reach out
via #tripleo on OFTC or the OpenStack Dev mailing list.

[OpenStack Infra (hudson-openstack)]

Change abandoned by "James Slagle <email address hidden>" on branch: master
Review: https://review.opendev.org/c/openstack/tripleo-common/+/723536
Reason: Abandoning this patch per the TripleO Patch Abandonment guidelines
(https://specs.openstack.org/openstack/tripleo-specs/specs/policy/patch-abandonment.html).
If you wish to have this restored and cannot do so yourself, please reach out
via #tripleo on OFTC or the OpenStack Dev mailing list.