ct_server: require explicit opt-in for plaintext gRPC to Trillian backends

summary:
`trillian/ctfe/ct_server` currently falls back to plaintext gRPC when `--trillian_tls_ca_cert_file` is not set, via `grpc.WithInsecure()` (callsite: `trillian/ctfe/ct_server/main.go:155` at commit `2f201161d90d8f216990e17c6c6423eebe7b3809`).

why this matters:
in deployments where ctfe ↔ trillian traffic crosses an untrusted or semi-trusted network segment, an on-path attacker can observe and potentially tamper with backend RPC traffic. this is easy to miss because the insecure behavior is the default when TLS is not explicitly configured.

proposal:
- keep TLS support as-is via `--trillian_tls_ca_cert_file`
- change the default behavior so plaintext is not silently used for non-local backends
- add an explicit unsafe opt-in flag, e.g. `--trillian_insecure_backend`, for deployments that intentionally want plaintext
- for backwards compatibility, allow plaintext by default only when all configured backends are local (loopback or unix socket), and emit a loud warning in that case

expected behavior (suggested):
- if `--trillian_tls_ca_cert_file` is set: use TLS
- else if `--trillian_insecure_backend` is set: allow plaintext (warn)
- else:
- allow plaintext only when all backends are local (warn)
- refuse to start if any backend is non-local, with an error message pointing to `--trillian_tls_ca_cert_file` (preferred) or `--trillian_insecure_backend` (unsafe override)

notes:
- this keeps local dev / single-host setups working without requiring TLS, while preventing accidental plaintext over a network boundary.
- if you prefer a stricter posture (no plaintext default at all, even for local), i can follow up with an alternative change.

Start in trillian/ctfe/ct_server/main.go at the grpc.WithInsecure() callsite around line 155, then trace the existing --trillian_tls_ca_cert_file handling. Implement the explicit plaintext opt-in and local-backend exception described in the issue, including warnings and a startup error for non-local backends without TLS or the override flag.

Written by the indexing model from the issue text.