outposts: configurable TLS ciphers

**Describe your question/**
2 part question -
1) Is there a way to manually configure which ciphers are exposed via 389 and 636 on a manually (or with docker-integration) deployed LDAP Outpost?
2) Should we be seeing 389 accept/negotiate TLS 1.2 connections? Scans are picking up TLS handshakes (with non-compliant ciphers) on TCP 389 - surprised me. Is the outpost set to optionally negotiate TLS on that port anyways (even though traditionally that is non-TLS LDAP)?

Our internal security team requires only specific ciphers are available on externally exposed ports (compliance, dont ask). We get around this on our kubernetes deployed instances by having Traefik handle the TLS termination with a `IngressRouteTCP` and sending everything internally to 389. But in our current testing when we have a manually deployed LDAP outpost to a docker host, we currently dont roll traefik, and we're hoping to just tweak the TLS settings internally.

**Relevant info**
"Noncompliant" cipher we're getting hit on: `ECDHE-RSA-AES128-SHA256` (they have requirements for higher key/hash algos)

**Screenshots**
n/a

**Logs**
n/a

**Version and Deployment (please complete the following information):**
- authentik version: ghcr.io/goauthentik/ldap:2025.4.0 - currently in testing, will upgrade to latest prior to going into production
- Deployment: multiple environments, some using docker-compose, some using helm.

**Additional context**
To be clear, I dont expect Authentik to change what ciphers they're using, just trying to figure out if its configurable. If it is not due to [golang's long history of unconfigurable ciphers](https://github.com/golang/go/issues/29349) (or similar issue), just let us know. We can roll traefik in front of the ldap outpost and handle it that way.