Explore is there way refresh TLS certificate without closing listener

Currently with each cert refresh we teardown the listeners and bring them back up again. This is the case for ns_server, and query(MB-61782). It is likely the case that this is true for all the services involved.

We need to consider allternate ways to refresh/rotate certs without downtime.
One of the option is put forth in MB-61782, copying snippet from bug.
----------------------------------------------------------------------
Read this https://blog.diogomonica.com/2017/01/11/hitless-tls-certificate-rotation-in-go/ or any other google. I am not sure if this works. But one should explore vs interrupt of service

Choosing the TLS config before the TLS handshake
https://github.com/couchbase/query/blob/master/server/http/service_endpoint.go#L494-L512

When we get certificates change recived why not we load certificate (under lock) in to HttpEndpoint (what we did below)

https://github.com/couchbase/query/blob/master/server/http/service_endpoint.go#L224-L241

Later use call back use that here https://github.com/couchbase/query/blob/master/server/http/service_endpoint.go#L244

Check FTS/Index services how they do? https://github.com/couchbase/cbft/blob/master/cmd/cbft/init_grpc.go#L77