Ability to change root certificate on the fly on agent

GOCBC-975

gocbcore agent is can be used multiple users multiple queries of same bucket.
couchbase cluster can set/reset node-node Encryption any time and also change RootCA certificate. When node-node encryption is enabled tls config with RootCA certificate must passed to all the connections (HTTP, memecached). Whenever setting changed it should detect and discard old connections and start new connections transiently (existing connection must continue until completion).

This allows no interruption on service.

If any way we can achieve this today please let us know. Opening new agent every change is not an option (because no way we know who all using old agent when to close). If that is only option at present then disabling encryption in transactions for N1QL until such functionality available.