Allow users to specify transport certificate authorities

[pebrc]

Fixes #962

• remove blacklisting for transport CAs (should we allow it for HTTP as well?)
• changes default behaviour when merging config to append on conflict instead of replacing in order to allow user provided CAs to be merged with our internal CA
• changes the validation checks to no longer rely on a naive prefix check but use ucfg's APIs instead.

With this in place we can configure mutual trust without relying on our TrustRelationship CRDs like so:

Consider this modified quickstart cluster:

apiVersion: elasticsearch.k8s.elastic.co/v1alpha1
kind: Elasticsearch
metadata:
  name: quickstart
spec:
  version: 7.1.0
  nodes:
  - nodeCount: 3
    config:
      node.attr.server_name: ${POD_NAME}.node.quickstart.default.es.cluster.local
      xpack.security.transport.ssl.certificate_authorities:
      - /usr/share/elasticsearch/config/other/ca.crt
    podTemplate:
      spec:
        containers:
        - name: elasticsearch
          volumeMounts:
          - name: testing-certs
            mountPath: /usr/share/elasticsearch/config/other
        volumes:
        - name: testing-certs
          secret:
            secretName: testing-es-transport-certs-public 

and a second cluster:

apiVersion: elasticsearch.k8s.elastic.co/v1alpha1
kind: Elasticsearch
metadata:
  name: testing
spec:
  version: 7.1.0
  nodes:
  - nodeCount: 1
    config:
      node.attr.server_name: ${POD_NAME}.node.testing.default.es.cluster.local
      xpack.security.transport.ssl.certificate_authorities:
      - /usr/share/elasticsearch/config/other/ca.crt
    podTemplate:
      spec:
        containers:
        - name: elasticsearch
          volumeMounts:
          - name: quickstart-certs
            mountPath: /usr/share/elasticsearch/config/other
        volumes:
        - name: quickstart-certs
          secret:
            secretName: quickstart-es-transport-certs-public

This would be the prerequisite to configure CCR/CCS w/o CRDs

[sebgl]

LGTM.
I don't see any reason the "append" merge approach would cause problems so far.

[thbkrkr]

LGTM