ztunnel CSR inconsistency with sidecar

[zliu-rh]

Tracking two issues we observed with CSRs from ztunnel:

1. Sidecar CSRs have a Subject of O= (organization blank), ztunnels CSRs do not have a Subject
2. When using the tls-ring feature, the CSR does not set the SAN extension as critical

---

1. is causing an issue with Istio RA's verification, discussion here
2. when combined with 1., causes issue with specific issuers (e.g. AWS PCA returns error MalformedCSRException: CSR must mark the SAN extension critical when it has an empty subject.)