[TLS] Wire TLS encryption into the server Netty pipeline

[affo]

Search before asking

• I searched in the issues and found nothing similar.

Description

Part of #3786 (FIP-29: (m)TLS Support).

Wave 1 — depends on: SSL config & context foundations (#3796).

Wires SslHandler into the server-side pipeline, enabling real encrypted connections for the first time — encryption only, no client-certificate requirement yet (ClientAuth.NONE on every TLS listener).

• ServerChannelInitializer — pipeline.addFirst("ssl", ...) for listeners in security.ssl.enabled.listeners, before the frame decoder.
• NettyServer / FlussProtocolPlugin — thread Configuration + listener name into createChannelHandler; minimal fail-fast validation (a TLS-enabled listener requires a keystore).
• TlsFileRegionHandler — copies file-backed log-fetch records into JVM memory before encryption, since sendfile and SslHandler are mutually exclusive.
• TlsClusterITCase — end-to-end cluster test with an encrypted listener.

Depends on: SSL config & context foundations (#3796).
Depended on by: client pipeline integration (#3797), internal listener migration (#3798), certificate hot-reload (#3799), mTLS authentication (#3793), Flink connector test (#3794), Spark connector test (#3800).

Estimated diff size: ~415 lines.

(Note: this replaces this ticket's original broader "server + client" scope, now split further into dedicated tickets.)

Willingness to contribute

• I'm willing to submit a PR!