Wire TLS configuration in Gateway reconciler to resolve Secret refs into inline PEM data

The Gateway reconciler previously ignored TLS configuration entirely (tls: None TODO).
This resolves HTTPS listener certificateRefs into inline PEM certificates in the data
plane ConfigMap, with proper cross-namespace ReferenceGrant checks and per-listener
ResolvedRefs status conditions.

Author: RobbieMcKinstry