ct_server: require explicit opt-in for plaintext gRPC to Trillian backends #1759

summary:
trillian/ctfe/ct_server currently falls back to plaintext gRPC when --trillian_tls_ca_cert_file is not set, via grpc.WithInsecure() (callsite: trillian/ctfe/ct_server/main.go:155 at commit 2f201161d90d8f216990e17c6c6423eebe7b3809).

why this matters:
in deployments where ctfe ↔ trillian traffic crosses an untrusted or semi-trusted network segment, an on-path attacker can observe and potentially tamper with backend RPC traffic. this is easy to miss because the insecure behavior is the default when TLS is not explicitly configured.

proposal:

• keep TLS support as-is via --trillian_tls_ca_cert_file
• change the default behavior so plaintext is not silently used for non-local backends
• add an explicit unsafe opt-in flag, e.g. --trillian_insecure_backend, for deployments that intentionally want plaintext
• for backwards compatibility, allow plaintext by default only when all configured backends are local (loopback or unix socket), and emit a loud warning in that case

expected behavior (suggested):

• if --trillian_tls_ca_cert_file is set: use TLS
• else if --trillian_insecure_backend is set: allow plaintext (warn)
• else:
  • allow plaintext only when all backends are local (warn)
  • refuse to start if any backend is non-local, with an error message pointing to --trillian_tls_ca_cert_file (preferred) or --trillian_insecure_backend (unsafe override)

notes:

• this keeps local dev / single-host setups working without requiring TLS, while preventing accidental plaintext over a network boundary.
• if you prefer a stricter posture (no plaintext default at all, even for local), i can follow up with an alternative change.