SPIFFE/Spire compatible TLS + x509/JWT-SVID termination

#### Feature Description

1. Consul terminates tls connections via spiffe/go-sdk, which in turn provisions and atomically cycles cryptographic material on `crypto/tls.Config`.

2. Consul further uses spiffe/go-sdk to validate JWT- or x509-SVIDs against a configurable set of workload identities (SPIFFE-IDs). (JWT-SVID can easilly cross the L7 boundary, while x509-SVID can double up for mTLS)

3. Consul accepts JWT-SVIDs (bearer tokens) directly as ACL tokens (to avoid the bothersome login step).

#### Use Case(s)

Zero trust environments governed by SPIFFE/spire.

/cc @manveru

X-ref:

- https://github.com/hashicorp/consul/issues/11974
- https://github.com/hashicorp/nomad/issues/11806
- https://github.com/hashicorp/vault/issues/13605

Start by mapping Consul's TLS termination, SPIFFE/go-sdk integration, SVID validation, and ACL token authentication entry points. Define the supported x509-SVID, JWT-SVID, workload-identity, and token flows, then verify that the resulting behavior covers the stated zero-trust use cases.

Written by the indexing model from the issue text.