Add support for NGINX Service Mesh internal routes

[kate-osborn]

Proposed changes

Add support for NGINX Service Mesh internal routes.

• Adds command line flag -enable-internal-routes which requires -spire-agent-address and -nginx-plus.
  If internal routes are enabled an internal route server block is generated to terminate tls connections using the Spiffe certs fetched from the Spire agent. Internal routes are created for Ingress resources that are annotated with nsm.nginx.com/internal-route: "true" and can only be accessed by services in NGINX Service Mesh.

• Changes -spire-agent-address to require -nginx-plus and removes SpiffeCerts config option from the oss templates.

Checklist

Before creating a PR, run through this checklist and mark each as complete.

• I have read the CONTRIBUTING doc
• I have added tests that prove my fix is effective or that my feature works
• I have checked that all unit tests pass after adding my changes
• I have updated necessary documentation
• I have rebased my branch onto master
• I will ensure my PR is targeting the master branch and pulling from my branch from my own fork