feat(restatectl): add TLS client flags for connecting to mTLS-secured clusters

[rushabhvaria]

Summary

Add --tls-ca, --tls-cert, and --tls-key flags to restatectl so operators can connect to Restate clusters running with strict mTLS on the fabric port. This makes strict mode fully usable without requiring optional mode as a workaround for admin operations.

Motivation

With strict mTLS enabled on port 5122, restatectl (which connects to NodeCtlSvc/ClusterCtrlSvc on the same port) would be unable to provision or manage the cluster without presenting a valid client certificate. This PR adds the necessary TLS client flags.

Usage

# With flags
restatectl --tls-ca /certs/ca.pem \
           --tls-cert /certs/admin.pem \
           --tls-key /certs/admin-key.pem \
           --address https://node:5122 \
           cluster-status

# With environment variables
export RESTATECTL_TLS_CA=/certs/ca.pem
export RESTATECTL_TLS_CERT=/certs/admin.pem
export RESTATECTL_TLS_KEY=/certs/admin-key.pem
restatectl --address https://node:5122 cluster-status

When TLS flags are omitted, behavior is unchanged (plaintext connection, same as today).

Changes

File	Change
crates/cli-util/src/opts.rs	Add tls_ca, tls_cert, tls_key to NetworkOpts with env var support
crates/cli-util/src/lib.rs	Re-export NetworkOpts for downstream crates
tools/restatectl/src/util.rs	grpc_channel_with_tls() — custom TLS connector using tokio-rustls
tools/restatectl/Cargo.toml	Add http, tokio-rustls, hyper-util, tower deps

Design

• Reuses TlsCertResolver from restate-core::network::tls to build the rustls ClientConfig
• Custom tower::service_fn connector wraps TCP with TLS per-connection (same pattern as inter-node outbound)
• --tls-cert requires --tls-key (enforced by clap)
• --tls-ca alone enables server cert verification without client auth (one-way TLS)

Verification

• cargo check -p restate-cli-util -p restatectl — compiles
• cargo clippy -D warnings — zero warnings
• cargo fmt --check — clean