Add an option to require StartTLS for LDAP connections on port 389

Add an LDAP provider or ldap outpost setting to require clients connecting on port 389 to upgrade the connection with StartTLS before they can bind, search, or perform other LDAP operations.

When this setting is enabled, authentik should permit the initial plaintext LDAP connection and StartTLS negotiation, but reject operations attempted before TLS is established with the LDAP `confidentialityRequired` response. This would allow organizations to support StartTLS on the standard LDAP port while preventing unencrypted binds, directory queries, and other LDAP traffic.

Start at the LDAP provider or ldap outpost configuration and the port-389 connection handling; trace where StartTLS negotiation and LDAP operations are processed. Done means an enabled setting permits plaintext connection setup and StartTLS but rejects pre-TLS binds, searches, and other operations with LDAP confidentialityRequired.

Written by the indexing model from the issue text.