[sdk-platform-java] DirectPath should only use the TLS endpoint

DirectPath channel [creation logic](https://github.com/googleapis/sdk-platform-java/blob/4aaea1ec89737ea150acb918584a234fcf426810/gax-java/gax-grpc/src/main/java/com/google/api/gax/grpc/InstantiatingGrpcChannelProvider.java#L630-L638) should in invoked using the TLS endpoint.

Right now, DirectPath uses the endpoint that is returned back from EndpointContext and this may be resolved to be either the TLS or mTLS endpoint based on [user configuration](https://github.com/googleapis/sdk-platform-java/blob/4aaea1ec89737ea150acb918584a234fcf426810/gax-java/gax/src/main/java/com/google/api/gax/rpc/EndpointContext.java#L351-L373).

(Stretch)
EndpointContext should be able to determine if DirectPath is enabled before resolving the endpoint. This would help both S2A and DirectPath to use the correct endpoint:

Logic should be
- If DirectPath enabled and S2A enabled: DirectPath with TLS
- If DirectPath enabled and S2A disabled: DirectPath with TLS
- If DirectPath disabled and S2A enabled: S2A with mTLS
- If DirectPath disabled and S2A disabled: Default flow with TLS

Start with the DirectPath channel creation logic in gax-java/gax-grpc/src/main/java/com/google/api/gax/grpc/InstantiatingGrpcChannelProvider.java at the linked lines, then read endpoint resolution in gax-java/gax/src/main/java/com/google/api/gax/rpc/EndpointContext.java at the linked lines. Trace how DirectPath, S2A, TLS, and mTLS choices interact, and confirm completion against the four endpoint-selection cases listed in the issue.

Written by the indexing model from the issue text.