feat(multicluster): sync target cluster trust roots into Link status

[alpeb]

Add cross-cluster trust visibility to the service-mirror, recording the
certificates a linked cluster advertises and trusts in the Link status.

This new functionality is opt-in per Link, based on the value of the new
multicluster chart value controllers[].enableTrustRootsMirroring
(defaults to false).

The RemoteClusterServiceWatcher now runs a periodic loop (gated on the
remote mirror, skipped for the local mirror) that reads the target
cluster's linkerd-identity-trust-roots-local (if declared) and
linkerd-identity-trust-roots ConfigMaps and patches the observations
into a new trustRoots subtree of the Link status. A JSON merge patch is
used so the existing mirrorServices/federatedServices status fields are
left untouched. Failed refreshes are treated conservatively, keeping the
previously synced observations and their lastSyncedTime so staleness
stays visible.

The new trustRoots field captures the local and effective trust bundles,
plus the effective bundle ConfigMap's annotations (filtered of noisy
kubectl/kubernetes.io entries) to carry auxiliary bundle metadata across
clusters. The absence of the local-roots ConfigMap is not an error;
only failure to read the effective mesh bundle is.

The field is added into the Link CRD without bumping its version, given
its additive nature.

Also extends the remote-access service-mirror RBAC to grant get access
to the two trust-roots ConfigMaps, and regenerates the CRD, deepcopy,
and install golden files accordingly.