Support system-internal-tls in net-gateway-api

[ReToCode]

Larger description in the Feature Track document
Parent-issue: knative/serving#11906
Gateway-API Issue: kubernetes-sigs/gateway-api#1897

Summary
net-gateway-api should support calling activator / backends with a known CA key and subject name.

This is currently blocked by upstream gateway-api, as there is no way to define it. More info:

• All hops encrypted amongst internal and external services in Knative knative/serving#11906 (comment)
• All hops encrypted amongst internal and external services in Knative knative/serving#11906 (comment)
• All hops encrypted amongst internal and external services in Knative knative/serving#11906 (comment)

/kind feature-request

[github-actions]

This issue is stale because it has been open for 90 days with no
activity. It will automatically close after 30 more days of
inactivity. Reopen the issue with /reopen. Mark the issue as
fresh by adding the comment /remove-lifecycle stale.

[ReToCode]

/remove-lifecycle stale

[dprotaso]

There's a redux happening with TLS validation and the BackendTLSPolicy will have a breaking change

See: kubernetes-sigs/gateway-api#2910