[TLS] Add zero-downtime internal listener migration (optional-SSL)

[affo]

Search before asking

• I searched in the issues and found nothing similar.

Description

Part of #3786 (FIP-29: (m)TLS Support).

Wave 2 — depends on: server pipeline integration (#3792).

Server↔server traffic uses a single internal listener; flipping it straight to TLS-only would partition the cluster mid-rollout. Add a transitional mode where the internal listener accepts both plaintext and TLS on the same listener (same name/port), via Netty's OptionalSslHandler:

• New config option: security.ssl.internal.accept-plaintext (boolean, default false) — restricted to the internal listener only; no effect on, and cannot be set for, public listeners.
• Validation: when enabled, the internal listener's auth protocol must not be mTLS (a plaintext peer presents no certificate) — refuse to start otherwise.
• Tests covering both directions on the same listener: plaintext passthrough and TLS upgrade.

Depends on: server pipeline integration (#3792).

Estimated diff size: ~100 lines.

Willingness to contribute

• I'm willing to submit a PR!