metrics with TLS should not check the client identity

## Proposal

This report is a companion to https://github.com/tikv/tikv/issues/7987

We recently (in TiKV 4.0, not 3.0) added the ability to have TLS with client CN verification. There are 2 problems with getting metrics now:

1. If TLS is enabled, the client must authenticate using a certificate with the same CN as any other client.
2. Allowing clients that only need metrics to access the entire API is a security problem.

We still need TLS. The proposed solution is to not check the CN for the metrics route. From a principles perspective separate authentication from authorization. For the metrics route authorization can be different.

It is ideal to also support verifying a different CN for metrics, but I suspect most would prefer to not bother with CN verification for the metrics route since they are read-only and only reveal the operational state of the system.