Load fleet.ssl.certificate and fleet.ssl.key from agent policy

[joshdover]

Similar to #2172 we need to support respecting the certificate and key values provided in an agent policy from Fleet which will be added in elastic/kibana#150709 for the next release. This is to support mTLS with proxies when connecting to Fleet.

The policy from Fleet will have the form:

fleet:
  hosts:
    - 'https://test-fs.com:8220/'
  proxy_url: 'https://my-proxy'
  ssl:
    certificate_authorities:
      - my-ca
    certificate: my-cert
    key: my-key

See the parent (private) issue for more details.

[cmacknz]

We will need to use the same precedence rules defined in #2304 (comment) to avoid problems, we need to ensure that if the certificate_authorities received from Fleet are empty or invalid we fall back to the ones used at enrollment if possible.

[elasticmachine]

Pinging @elastic/elastic-agent-control-plane (Team:Elastic-Agent-Control-Plane)

[ycombinator]

The PR that might resolve this issue is currently blocked on #4497.

[nimarezainia]

The PR that might resolve this issue is currently blocked on #4497.

@ycombinator @pierrehilbert can I assume they both can be completed in sp29?

[ycombinator]

The PR that might resolve this issue is currently blocked on #4497.

@ycombinator @pierrehilbert can I assume they both can be completed in sp29?

I'm reasonably confident you can, given the time left in the sprint and where @pchila is pretty much done with #3090. But let's wait for @pchila to give us a better assessment once he's had a chance to look into all the mTLS issues and PRs on his plate this sprint.