Contour should document the gRPC TLS rotation process

[youngnick]

Contour should have at least documentation on how to rotate the certificates used for securing gRPC traffic with TLS, currently generated by contour certgen.

An automated solution to perform the rotation might be acceptable as long as it's tightly scoped to only rotate those certificates, but would need a design doc to ensure that we don't increase the scope of Contour too much, and in order to write that, someone is going to need to figure out how to actually do the rotation.

So, the first step is to document how to rotate the certificates manually (possibly using certgen from a terminal). Then we can consider if and how we automate.

[jpeach]

Related to #2023 and #2017

[jpeach]

Duplicate of #1857