obs: cockroach gen metric-list may miss metrics guarded by Insecure check

## Description

`cockroach gen metric-list` (which generates `docs/generated/metrics/metrics.yaml`)
starts a test server with `Insecure: true` (`pkg/cli/gen.go:445`). Any metrics
whose registration is guarded by `!cfg.Insecure` will be silently absent from
`metrics.yaml`, and therefore invisible to downstream tools like
`cockroach-metric-sync`.

This was discovered when all `security.certificate.*` metrics (expiration, TTL,
last_rotation, expiry_days) were found missing from `metrics.yaml`. The
immediate fix is in #170425 (register stub metrics in insecure mode).

## Systemic fix ideas

1. **Start the gen server in secure mode** using auto-generated test certs
(which `testutils` already supports), so the metric registry matches
production.
2. **Add a CI check** that compares AST-discovered metrics (`metricscan/scan.go`)
against runtime-discovered ones (`metrics.yaml`) and flags any gaps.
3. **Lint rule** that warns when `AddMetricStruct` is called inside an
`if !cfg.Insecure` block.

Any of these would prevent future metrics from silently disappearing from the
generated catalog.

## Jira issue: none

Epic: none

Jira issue: CRDB-63989