Design/document the contract for Serving Encryption

## Description
Discuss/design the contract for cluster-local and Knative internal encryption.

## Tasks
- [ ] Draft a design contract for cluster-local and Knative internal encryption with changes to the Knative specification (if needed)
- [ ] Update the Knative specification in code & docs
- [ ] Create/Update conformance tests for networking implementations
- [ ] Add e2e tests in serving to enforce encryption + a full CA rotation

## Related work
- Parent issue: https://github.com/knative/serving/issues/11906
- Findings document: https://docs.google.com/document/d/1YdcdBVg_zpT4WSNRsWlihut5JuLddOTIggFvLni3A28/edit?disco=AAAAtaDADjo

/area networking
/kind spec

Start with the parent issue and the linked findings document to understand the proposed contract for cluster-local and Knative internal encryption. Done means the contract is drafted, the Knative specification and related code/docs are updated, conformance tests cover networking implementations, and Serving has end-to-end encryption and full CA-rotation tests.

Written by the indexing model from the issue text.