[Story] Redeploy workloads using agent auto-config when certs are renewed

[ebaron]

We should also probably implement something similar for agent auto-configuration. This will be trickier though as it can only be done at the pod template level and we currently only operate on pods. This would depend on #1088.

Originally posted by @ebaron in #1112 (comment)