Fix TLS Cert when using enableAutoEncrypt

[t-eckert]

Changes proposed in this PR:

• The generated cert will always mount to consul-ca-cert
• The controller will use the cert at consul-ca-cert to talk to servers if running without clients. It will use consul-auto-encrypt-ca-cert to talk to clients only if running with clients.

How I've tested this PR:

• Updated BATS
• Deployed successfully with the following configurations, verifying that the controller received the correct cert and was able to talk to the server or client depending on the configuration.
  • tls.enableAutoEncrypt=false client.enabled=false apiGateway.image=...0.5.1
  • tls.enableAutoEncrypt=true client.enabled=false apiGateway.image=...0.5.1
  • tls.enableAutoEncrypt=false client.enabled=true apiGateway.image=...0.5.1
  • tls.enableAutoEncrypt=true client.enabled=true apiGateway.image=...0.5.1
  • tls.enableAutoEncrypt=true client.enabled=true apiGateway.image=...0.4.0

How I expect reviewers to test this PR:

• BATS
• Testing that the configuration that originally caught this bug works correctly:

global:
  logLevel: "trace"
  acls:
    manageSystemACLs: true
  image: hashicorp/consul:1.14.1
  imageK8S: hashicorp/consul-k8s-control-plane:1.0.1
  tls:
    enabled: true
    enableAutoEncrypt: true
apiGateway:
  enabled: true
  image: hashicorp/consul-api-gateway:0.5.1
  logLevel: debug
  managedGatewayClass:
    enabled: true
    serviceType: LoadBalancer
connectInject:
  enabled: true
controller:
  enabled: true
server:
  replicas: 1
client:
  enabled: true

Checklist:

• Tests added
• CHANGELOG entry added

  HashiCorp engineers only, community PRs should not add a changelog entry.
  Entries should use present tense (e.g. Add support for...)

[curtbushko]

Looks good!