Support configuring custom CA to validate TLS connection with Kafka

[inge4pres]

Describe current state

AFAICT there is not a way to set the RootCAs field for the TLS field of CommonConfig

apm-queue/kafka/common.go

Line 127 in 1822363

TLS *tls.Config

When the CA used to sign the TLS certificate of the Kafka connection is not part of the system pool, it should be possible to add other CAs as part of it.

Describe the desired state

The handling of TLS configurations seems to be happening in

apm-queue/kafka/common.go

Lines 212 to 218 in 1822363

	case cfg.TLS == nil && cfg.Dialer == nil && os.Getenv("KAFKA_PLAINTEXT") != "true":
	// Auto-configure TLS from environment variables.
	cfg.TLS = &tls.Config{}
	if os.Getenv("KAFKA_TLS_INSECURE") == "true" {
	cfg.TLS.InsecureSkipVerify = true
	}
	}

We should allow configuring (parts of) the TLS field, most notably the CA, since it will be used to validate TLS certificate authenticity when KAFKA_TLS_INSECURE is set to false.

[marclop]

Not that we need to use this library, but https://github.com/twmb/tlscfg/blob/main/tlscfg.go has some samples on how to add certificate key pairs to the tls.Config