Separate TLS certificates for TiDB clients.

[kolbe]

Feature Request

Is your feature request related to a problem? Please describe:

Right now, we have a single TiDBClientTLSSecretName in the cluster, which is shared between BR and PD and TidbInitializer:

$ grep -r TiDBClientTLSSecretName
tests/e2e/tidbcluster/tls.go:           secretName := util.TiDBClientTLSSecretName(tcName)
pkg/util/util.go:func TiDBClientTLSSecretName(tcName string) string {
pkg/manager/member/tidb_init_manager.go:                                        SecretName: util.TiDBClientTLSSecretName(tcName),
pkg/manager/member/pd_member_manager.go:                                        SecretName: util.TiDBClientTLSSecretName(tc.Name),
pkg/backup/backup/backup_manager.go:            clientSecretName := util.TiDBClientTLSSecretName(backup.Spec.BR.Cluster)
pkg/backup/restore/restore_manager.go:          clientSecretName := util.TiDBClientTLSSecretName(restore.Spec.BR.Cluster)

For security/compliance purposes, some customers prefer to have separate user accounts that are authenticated using specific certificate Subjects, so we should provide a mechanism to use separate client certificates (and usernames, where that's configurable) for each client role.

[kolbe]

Oops, looks like backup and restore actually do support their own client certificate configurations, so perhaps this issue only affects PD (just the Dashboard?) and TidbInitializer.