[TLS] Add zero-downtime internal listener migration (optional-SSL)

### Search before asking

- [x] I searched in the [issues](https://github.com/apache/fluss/issues) and found nothing similar.

### Description

Part of #3786 ([FIP-29: (m)TLS Support](https://cwiki.apache.org/confluence/spaces/FLUSS/pages/406620533/FIP-29+m+TLS+Support)).

**Wave 2** — depends on: server pipeline integration (#3792).

Server↔server traffic uses a single internal listener; flipping it straight to TLS-only would partition the cluster mid-rollout. Add a transitional mode where the internal listener accepts both plaintext and TLS on the same listener (same name/port), via Netty's `OptionalSslHandler`:

- New config option: `security.ssl.internal.accept-plaintext` (boolean, default `false`) — restricted to the internal listener only; no effect on, and cannot be set for, public listeners.
- Validation: when enabled, the internal listener's auth protocol must not be `mTLS` (a plaintext peer presents no certificate) — refuse to start otherwise.
- Tests covering both directions on the same listener: plaintext passthrough and TLS upgrade.

**Depends on:** server pipeline integration (#3792).

_Estimated diff size: ~100 lines._

### Willingness to contribute

- [x] I'm willing to submit a PR!

Start by reading the server pipeline integration in #3792 and the Netty OptionalSslHandler behavior. Trace the internal listener configuration and validation, then cover plaintext passthrough and TLS upgrade on the same listener. Done means the new security.ssl.internal.accept-plaintext option is internal-only, defaults to false, and rejects mTLS authentication when enabled.

Written by the indexing model from the issue text.