Centralize TLS dial configuration

(Ctsy. Opus)

Background

In #1775 we landed TLS certificate verification for the RFQ price
oracle dial, with the per-call configuration encapsulated in a new
rfq/tls.go helper. During review we discussed extending the same
pattern to other outbound gRPC dial sites, but agreed it was out of
scope for that PR. Filing this as the follow-up.

The crypto/tls import sites today (on main, excluding itest/,
docs/, and test files) are:

• proof/courier.go (HashMail + UniverseRPC couriers)
• rpcserver/universe_rpc_registrar.go (federation
  push/sync/diff/supply-sync)
• authmailbox/client.go
• rfq/tls.go (the helper added in #1775)
• tapcfg/config.go
• cmd/commands/conn.go
• internal/lncfg/address.go
• internal/test/grpc.go

Each dial site grew its own combination of dial options, root-CA
loading, and skip-verify handling at different points in time. The
result is that adding or auditing a TLS-related config flag means
touching several packages, and behaviour subtly diverges across
them (e.g. whether system roots are used, how pinned certs are
loaded, how the insecure path is opted into).

Proposal

Lift the rfq/tls.go pattern into a small shared package
(working name: taptls or similar) that owns:

• Construction of a *tls.Config from a shared config struct
  (system roots vs. pinned cert file, server name override,
  explicit insecure opt-in).
• A canonical helper that returns []grpc.DialOption for the
  common case, so callers don't reimplement the dial-option dance.
• A single, clearly-named config knob for the insecure path so it
  is grep-able and consistently documented.

Migrate the dial sites above to use the shared helper, leaving
their package-local code limited to "build the config struct, call
the helper, dial".

Non-goals

• No behaviour change for the default config; this is a refactor.
• No change to the user-visible config flag names beyond what is
  needed for consistency.

Out of scope (could be follow-ups)

• Mutual TLS / client certificates for outbound dials.
• Pinned-public-key (SPKI) verification.

Start by reading rfq/tls.go, then compare its configuration and dial handling with the listed sites: proof/courier.go, rpcserver/universe_rpc_registrar.go, authmailbox/client.go, tapcfg/config.go, cmd/commands/conn.go, and internal/lncfg/address.go. Done means those outbound dial sites use one shared TLS helper, with default behavior preserved and the insecure path consistently named and documented.