[RORDEV-2145] Document PKI auth feature

[coutoPL]

Adds the pkis connector, the pki_authentication / pki_authorization / pki_auth rules, and brings the encryption section up to date: client_authentication is no longer a boolean but none / optional / required.

The connector section leads with what stops PKI working rather than with syntax, because all three failure modes are silent. TLS terminated at a load balancer means no certificate ever reaches the node; client_authentication left at none means the node never asks for one; and ReadonlyREST cannot warn about either, since the ACL has no view of the TLS configuration.

It also warns that PKI is only as strong as the verification the TLS layer performs. verification_mode: none makes Elasticsearch request a certificate and validate nothing, so anyone who can run a CA can issue one carrying a service's CN and be authenticated as that service - which is the strongest argument for pinning issuer_dn.

The Active Directory case is called out early: the login identity is the UPN and is absent from the DN entirely, so a CN-based provider yields an unusable username and no pattern can recover it.

Summary by CodeRabbit

• Documentation
  • Added guidance for configuring mutual TLS modes and certificate-based client authentication.
  • Documented PKI authentication, authorization, and combined access-control rules.
  • Added PKI provider configuration details, including certificate identity and group extraction.
  • Included LDAP integration, certificate restrictions, validation requirements, migration guidance, and operational limitations.