Make legacy StartTLS support configurable (and disabled by default)

**Is your feature request related to a problem? Please describe.**
PR #5861 added StartTLS support and enabled it by default. It is however a discouraged and obsolete technology which can be misused to force fallbacks to an insecure connection.

**Describe the solution you'd like**
From a security standpoint it must be possible to disable StartTLS support (and should likely be the default).

**Describe alternatives you've considered**
Remove StartTLS support completely. While this is likely the safest and modern choice there might be legacy applications which do not support implicit TLS.

**Additional context**
It is possible to find some sources which claim that LDAPS is deprecated in favor of StartTLS. These claims generally originate from an [old FAQ entry on the OpenLDAP page](https://www.openldap.org/faq/data/cache/605.html). It is, however, not up-to-date and unmaintained and the [current stance by the maintainers has changed which are now discouraging StartTLS](https://lists.openldap.org/hyperkitty/list/openldap-technical@openldap.org/thread/IXEZAGCOTL5CTSOFNFDE65LURQET6ZZV/#LZ4N3JHGKZVDXRIXNRAM4SHZ44B5U4BP) due to its clear weaknesses.

---
Discussion from the original PR:

> Currently there isn't a way to disable StartTLS, but usually starttls is preferable to direct SSL as direct SSL doesn't allow for selecting the certificate based on the initial request

_Originally posted by @BeryJu in https://github.com/goauthentik/authentik/issues/5861#issuecomment-1634487085_

> Does LDAPS not support SNI? I seem to remember other implementations seem to support it. This is after all also how reverse proxies do it for HTTPS...
>
> Also I am not sure on the way STARTTLS is implemented for LDAP though unless there are some significant differences from STARTTLS for SMTP then there exist [security disadvantages](https://serverfault.com/a/648282/543564) which even the RFC talks about. Even more so, [RFC 8314](https://datatracker.ietf.org/doc/html/rfc8314#section-3) officially obsoletes all cleartext/STARTTLS versions of mail protocols in favor of implicit TLS. In short, an attacker may disrupt the STARTTLS setup in which case many clients will fall back to unencrypted LDAP. And in general it is also not possible to force clients to use TLS whereas with LDAPS I can simply choose to not expose any unencrypted LDAP at all (which is also what we currently do).

_Originally posted by @septatrix in https://github.com/goauthentik/authentik/issues/5861#issuecomment-1634668590_