Add listener mTLS support with OCI CAs and CA bundles

[hollandm]

Closes #155

Summary

• Add the oci-native-ingress.oraclecloud.com/client-ca-ocids annotation for listener mTLS.
• Support comma-separated OCI Certificates service CA and CA Bundle OCIDs.
• Add the optional oci-native-ingress.oraclecloud.com/client-ca-verify-depth annotation, with a default verification depth of 3.
• Reconcile mTLS enablement, CA rotation, verification-depth changes, and removal.
• Deduplicate and canonicalize trusted CA identifiers so ordering differences do not cause conflicts or unnecessary updates.
• Reject conflicting mTLS settings on shared listener ports and require TLS when mTLS is configured.
• Preserve the listener SSL configuration during unrelated listener updates.
• Document the annotations, validation rules, defaults, and shared-listener requirements.

Validation

• go test ./...
• Repository CI unit-test and coverage command
• go vet for all changed packages
• Linux AMD64 production binary build using vendored dependencies
• Focused race-detector tests for the changed mTLS paths

Live validation was completed in a test environment using an OCI CA Bundle:

• A missing client certificate was rejected.
• A trusted client chain containing an intermediate CA was accepted.
• A client signed by an untrusted CA was rejected.
• Rotating to another CA Bundle changed trust as expected.
• Removing the annotation disabled mTLS.
• Restoring the annotation re-enabled enforcement.
• The OCI listener reported peer verification enabled with verification depth 3.

OCI Certificates service CA OCIDs and CA Bundle OCIDs use the same trustedCertificateAuthorityIds listener field. Both OCID forms are covered by parsing and reconciliation tests.

[oracle-contributor-agreement]

Thank you for your pull request and welcome to our community! To contribute, please sign the Oracle Contributor Agreement (OCA).
The following contributors of this PR have not signed the OCA:

• PR author: hollandm
• matt.holland@cerner.com

To sign the OCA, please create an Oracle account and sign the OCA in Oracle's Contributor Agreement Application.

When signing the OCA, please provide your GitHub username. After signing the OCA and getting an OCA approval from Oracle, this PR will be automatically updated.

If you are an Oracle employee, please make sure that you are a member of the main Oracle GitHub organization, and your membership in this organization is public.

[hollandm]

Spoke with a reviewer directly, they asked me to swap this to JSON style config similar to https://docs.oracle.com/en-us/iaas/Content/ContEng/Tasks/contengsettingupnativeingresscontroller-configuring.htm#contengsettingupnativeingresscontroller_configuringcookie-basedsessionpersistence