docs: Notes about WAN Federation when using Vault as Connect CA

[david-yu]

Closes #11684

Added details to intermediate_pki_path and root_pki_path options.

[hashicorp-ci]

🤔 This PR has changes in the website/ directory but does not have a type/docs-cherrypick label. If the changes are for the next version, this can be ignored. If they are updates to current docs, attach the label to auto cherrypick to the stable-website branch after merging.

[dnephin]

Thank you for improving these docs!

I believe these constraints exist for both WAN fed "modes" (WAN-fed and WAN-fed over mesh gateway), right? Also I think it might be worth clarifying that currently all DCs must point at the same Vault cluster. That was my assumption, and these docs edits appear to confirm that.

I believe these docs updates are correct for the current implementation, I do wonder if these limitations are actually a bug. I believe I remember @banks saying something a while ago about it should be possible for each DC to use a separate Vault cluster.

I looked at the code, and it does seem like it should be possible for secondary DCs to use separate Vault clusters with a few small code changes, and I believe we've heard reports of users wanting to do that very thing on multiple occasions. I'll bring up that issue with the team to see how we should proceed.

[trujillo-adam]

Added a few suggestions

[dnephin]

I believe this PR will address #11684

[hc-github-team-consul-core]

🍒 If backport labels were added before merging, cherry-picking will start automatically.

To retroactively trigger a backport after merging, add backport labels and re-run https://circleci.com/gh/hashicorp/consul/510852.

[hc-github-team-consul-core]

🍒❌ Cherry pick of commit 29c791c onto stable-website failed! Build Log

[hc-github-team-consul-core]

🍒❌ Cherry pick of commit 29c791c onto release/1.10.x failed! Build Log