*: support reload tls used by mysql protocol in place

[lysu]

What problem does this PR solve?

ref #14666

preliminary support reload tls used by mysql protocol

this PR doesn't try to full support mysql's dynamic modify "ssl_ca/ssl_key/ssl_cert" value, but can reload tls used old file path specified by old "ssl_ca/ssl_key/ssl_cert" value(so ssl_cert/ssl_ca/ssl_key keep read-only after this PR).

so user can:

1. start TiDB with ssl-ca, ssl-key and ssl-cert config like https://pingcap.com/docs/stable/reference/security/cert-based-authentication/#install-openssl
2. replace new file specified in ssl-ca, ssl-key and ssl-cert
3. use super user(here need new priv in following pr) to execute alter instance reload tls

then all new db connection will use new cert file, old connection will keep work just like mysql does

What is changed and how it works?

• extract common method LoadTLSCertificates
• make server.tlsConfig can be atomic swap
• let alter instance reload tls do reload

Check List

Tests

• Unit test
• Integration test

Code changes

• impl change

Side effects

• n/a

Related changes

• 4.0 only

Release note

• support reload tls used by mysql protocol in place.

---

This change is 

[tiancaiamao]

[2020-02-19T06:31:54.630Z] ----------------------------------------------------------------------
[2020-02-19T06:31:54.630Z] FAIL: tidb_test.go:468: tidbTestSuite.TestReloadTLS
[2020-02-19T06:31:54.630Z] 
[2020-02-19T06:31:54.630Z] tidb_test.go:524:
[2020-02-19T06:31:54.630Z]     c.Assert(err, IsNil)
[2020-02-19T06:31:54.631Z] ... value tls.RecordHeaderError = tls.RecordHeaderError{Msg:"first record does not look like a TLS handshake", RecordHeader:[5]uint8{0x17, 0x0, 0x0, 0x2, 0xff}, Conn:(*net.TCPConn)(0xc003beb3b0)} ("tls: first record does not look like a TLS handshake")
[2020-02-19T06:31:54.631Z] 
[2020-02-19T06:31:54.631Z] 
[2020-02-19T06:31:54.631Z] ----------------------------------------------------------------------

[kolbe]

I'd like to see this backported to 3.1 and maybe 3.0.

[lysu]

/rebuild

[lysu]

/rebuild

[codecov]

Codecov Report

Merging #14749 into master will not change coverage by %.
The diff coverage is n/a.

@@             Coverage Diff             @@
##             master     #14749   +/-   ##
===========================================
  Coverage   80.6497%   80.6497%           
===========================================
  Files           502        502           
  Lines        133409     133409           
===========================================
  Hits         107594     107594           
  Misses        17426      17426           
  Partials       8389       8389           

[lysu]

/rebuild

[lysu]

@jackysp @tiancaiamao finally it passes all test, PTAL tks~

[jackysp]

LGTM

[tiancaiamao]

LGTM

[tiancaiamao]

/merge

[sre-bot]

/run-all-tests

[sre-bot]

cherry pick to release-3.0 in PR #15080

[sre-bot]

cherry pick to release-4.0 in PR #15081

[sre-bot]

It seems that, not for sure, we failed to cherry-pick this commit to release-3.1. Please comment '/run-cherry-picker' to try to trigger the cherry-picker if we did fail to cherry-pick this commit before. @lysu PTAL.