As a mesh administrator, I want to be able to rotate my root certificate without breaking an existing federation, so that I can safely operate my mesh.

Acceptance Criteria:

• Mesh administrators must be able to rotate their mesh’s root certificate without interrupting traffic between local and imported services.
• Root cert changes are picked up by other meshes automatically
• Certificate changes are communicated over the /watch endpoint