feat: Keep all unexpired certs in istio-gatway-secret ca.crt

[c-pius]

Description

Changes proposed in this pull request:

• introduces the bundler.go with the functionality to
  • add new certs to a bundle
  • drop expired certs from a bundler
• updated the handler.go to use bundler adding for managing the istio-gateway-secret CA bundle (ca.crt)
• this PR just introduces the plain changes needed to fulfill the story so we can included in this weeks release. There will be a follow-up PR with some refactorings in the handler.go to make things nicer.

Related issue(s)

• Keep all unexpired CA certs in the CA bundle #2983

[lindnerby]

Just a few questions basically.

[c-pius]

@lindnerby FYI: noticed that there was a bug and fixed it fd55a8b

Not detected by the unit test as the NotAfter was explicitly set to zero, but the NotBefore was also implicitly zero:

	bndlr := certificate.NewBundler(
		certificate.WithParseX509Function(
			func(_ []byte) (*x509.Certificate, error) {
				return &x509.Certificate{
					NotAfter: time.Time{},
				}, nil
			},
		),
	)