CertPoolWatcher is currently only set up to support pull CAs in operator-controller. 

It needs to be added to operator-controller for support of pull CAs. The HttpsClient uses a pool watcher to get its CAs, but nothing is watching the pool of pull secrets.

Catalogd also needs a CertPoolWatcher for it's pull CAs.

CertPoolWatcher also needs to restart the app when it determines that the SystemCertPool needs to be updated, as that pool cannot be updated once created. This is usually detected through changes to files referenced via SSL_CERT_FILE and SSL_CERT_DIR, as the SystemCertPool is referenced that way.