changefeedccl: set tls_enabled when user specifies sasl_mechanism

In our [docs](https://www.cockroachlabs.com/docs/stable/create-changefeed) we say:
> You must have `tls_enabled` set to true to use SASL.

However, we don't enforce this requirement in code. We should either return an error when the user does not specify `tls_enabled` when they set `sasl_mechanism` or perhaps set it for them (this doesn't seem that bad given we do that already if they're using Confluent Cloud or Azure Event Hubs sinks).

Alternatively, maybe `tls_enabled` should just always default to `true` but we'll still give users the option to disable it if they so choose.

Jira issue: CRDB-41606

Start with the linked create-changefeed documentation and inspect the current changefeed handling for sasl_mechanism and tls_enabled. Confirm with maintainers whether to reject missing TLS, infer it, or change the default, then add coverage for the chosen behavior and update the documentation.

Written by the indexing model from the issue text.