docs: complete the TLS Certificate Grab page
Was a summary; now a reference an operator can act on.
Adds what tlsx actually is and links ProjectDiscovery's repository, a
screenshot of the settings section with every control visible, and an
explanation of each parameter including what the four deeper probes cost and
why each is off by default.
Adds the full list of integration points. The grab is one phase but the
certificate it captures is read in a dozen places, and only the phase was
documented: SAN hostname feedback, vhost/SNI candidates, subdomain-takeover
scoring, the six TLS hygiene checks, CDN attribution from the issuer, Service
enrichment, the graph, Red Zone shared-infrastructure clustering, the report,
and export/import.
Adds a "results that look wrong but are not" section, which is the half of the
documentation that saves an operator an afternoon: no COVERS_HOST edges in IP
mode (scope containment fails closed without an apex), empty findings when the
Security Checks master toggle is off, weak ciphers never reported because
tlsx's Go TLS client cannot negotiate one, and port 465 named `urd` because
that is its IANA registration while the hint carries the observed `smtps`.
Also documents how to verify it end to end against testing/guinea_pigs/tls_target.