Load fleet.ssl.certificate_authorities from agent policy

[joshdover]

Similar to #2172 we need to support respecting the certificate authority provided in an agent policy from Fleet:

key: my-cert-key
fleet:
  hosts:
    - 'https://test-fs.com:8220/'
  proxy_url: 'https://my-proxy'
  ssl:
    certificate_authorities:
      - my-ca

This is already provided by Fleet in 8.7, so marking this as a bug on the agent side. Backporting to 8.7 is preferable. See the parent (private) issue for more details.

[cmacknz]

We will need to use the same precedence rules defined in #2304 (comment) to avoid problems, we need to ensure that if the certificate_authorities received from Fleet are empty or invalid we fall back to the ones used at enrollment if possible.

[elasticmachine]

Pinging @elastic/elastic-agent-control-plane (Team:Elastic-Agent-Control-Plane)

[ycombinator]

The PR that might resolve this issue is currently blocked on #4497.

[nimarezainia]

Looks like this is all blocked due to #4770 and we can close once merged.

[ycombinator]

@nimarezainia Correct, merging #4770 will close #2247 and #2248.