[inputs.influxdb_listener] add support for Certificate Revocation Lists (CRL)

## Feature Request

When using telegraf as a secure reverse proxy for device communication with InfluxDB using mTLS, I would like to be able to revoke individual devices access to the system by specifying a CRL to the plugin.

### Proposal:

Make the influxdb_listener support a list of revoked certificates that are not allowed access, even though the certificates are signed by the specified CA certificate.

### Current behavior:

AFAIK, to revoke access to a device, the CA certificate must be changed, and new certificates must be created for all the devices for which access should not be revoked.

### Desired behavior:

By specifying a list of certificates that are denied access, it is not necessary to updated all the devices that shall retain access with new certificates

### Use case:

If a device is decommissioned, stolen or compromised, its access can be revoked without having to update all the other devices with new certificates

### references

https://community.influxdata.com/t/revoking-client-certificates-in-telegraf-influxdb-listener/22180

Start by examining the inputs.influxdb_listener plugin and its existing mTLS certificate validation path. Use the linked reference to understand CRL expectations, then determine how revoked client certificates should be configured and rejected while other certificates signed by the CA continue to work. Done means the listener denies certificates on the configured revocation list without requiring replacement certificates for other devices.

Written by the indexing model from the issue text.