Currently the route for the gateway is passthrough (https://github.com/grafana/tempo-operator/blob/748b121779ec4cf440c01f456abd148e20f5c008/internal/webhooks/tempostack_webhook.go#L41) by default. Let's switch this to re-encrypt to enable access from outside the cluster (the generated service-cert only allows the internal hostname, i.e. service.svc.cluster.local)

Update for TempoStack and TempoMonolithic.