xds: Implement system root certs support

[arjan-bal]

As per gRFC A82, xDS client should be able to use system root certificates to validate server identity if the use of system root certs is configured by the xDS management server. This is useful when the gRPC server is behind a reverse proxy. As per the gRFC, the feature is behind a feature flag till it is proven stable.

RELEASE NOTES:

• xds: Client can use system root certificates to validate server identity when configures by the xDS management server. To enable this feature, set the environment variable GRPC_EXPERIMENTAL_XDS_SYSTEM_ROOT_CERTS to true (case insensitive). See gRFC A82 (A82: xDS System Root Certificates proposal#436) for details.

[codecov]

Codecov Report

Attention: Patch coverage is 78.57143% with 18 lines in your changes missing coverage. Please review.

Project coverage is 82.32%. Comparing base (130c1d7) to head (985bbbd).
Report is 18 commits behind head on master.

Files with missing lines	Patch %	Lines
xds/internal/xdsclient/xdsresource/type_cds.go	50.00%	12 Missing and 2 partials ⚠️
xds/internal/balancer/cdsbalancer/cdsbalancer.go	83.33%	2 Missing and 1 partial ⚠️
...ds/internal/xdsclient/xdsresource/unmarshal_cds.go	96.42%	0 Missing and 1 partial ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##           master    #8013      +/-   ##
==========================================
+ Coverage   81.93%   82.32%   +0.38%     
==========================================
  Files         381      383       +2     
  Lines       38581    38824     +243     
==========================================
+ Hits        31613    31963     +350     
+ Misses       5640     5539     -101     
+ Partials     1328     1322       -6     

Files with missing lines	Coverage Δ
internal/testutils/xds/e2e/clientresources.go	98.21% <100.00%> (+0.03%)	⬆️
...ds/internal/xdsclient/xdsresource/unmarshal_cds.go	86.72% <96.42%> (+0.65%)	⬆️
xds/internal/balancer/cdsbalancer/cdsbalancer.go	81.64% <83.33%> (-0.11%)	⬇️
xds/internal/xdsclient/xdsresource/type_cds.go	50.00% <50.00%> (ø)

... and 48 files with indirect coverage changes

[easwars]

Mostly LGTM. Mainly minor comments.

[easwars]

I think this line is redundant, right, because we override systemRootCertsFunc right below.

[arjan-bal]

You're right, it's a copy/paste error. Removed it.

[easwars]

Nit: since the context is the only parameter, can't we omit the _ parameter name?

[arjan-bal]

Done.