Make SAN optional and move it to Instance

[sergiopozoh]

Proposed changes

• SAN must be made optional. It is also worth considering if we should move it to Instance, as right now is at the FederatedService level.

Reasons

• Now that Hamlet supports cleartext protocols, but SAN is still mandatory.

Alternatives

• Leave SAN in FederatedService. Feels unnatural. But even though, the implementor agent can always fill the array with all the valid SANs. How to select the right one for each Instance would be the challenge (assuming each Instance has its own cert with a single value SAN).
• Put SAN in Instance. We are assuming that each Instance will present its own certificate with a single value in the SAN. Maybe this is the right thing to do, given that SNI is already at the Instance. Maybe all instances present the same certificate with a multi-value SAN.

[sergiopozoh]

@dkalani @venilnoronha thoughts?

[sergiopozoh]

SAN is already optional in the spec document, it's only the protobuf comment what must be changed