[chore] Clarify TLS docs: mTLS is optional, not mandatory (#15143)

## Summary

Rewords the TLS configuration documentation to clarify that mutual TLS
(mTLS) is optional and standard TLS works by default.

Fixes #13757

## Problem

The current documentation reads as if `cert_file` and `key_file` are
always required ("the following parameters are also required"), which
leads readers to believe that mTLS is mandatory. This causes confusion
for users who only need standard TLS (server certificate verification).

## Changes

- Clarified upfront that standard TLS works by default with system root
CAs
- Explicitly stated mTLS is optional
- Reworded "the following parameters are also required" to "the
following certificate parameters can be configured"
- Clarified when `cert_file`/`key_file` are actually needed (server:
always for TLS, client: only for mTLS)
- Moved `ca_file` before `cert_file`/`key_file` since it's the more
commonly needed parameter

## Test Plan

- [x] Documentation-only change

Co-authored-by: Bogdan Drutu <bogdandrutu@gmail.com>
Co-authored-by: Alex Boten <223565+codeboten@users.noreply.github.com>

Author: 3 people

config/configtls/README.md

@@ -4,14 +4,18 @@ Crypto TLS exposes a [variety of settings](https://godoc.org/crypto/tls).
 Several of these settings are available for configuration within individual
 receivers or exporters.
 
-Note that mutual TLS (mTLS) is also supported.
+Note that mutual TLS (mTLS) is also supported as an optional enhancement on
+top of standard TLS.
 
 ## TLS / mTLS Configuration
 
-By default, TLS is enabled:
+By default, TLS is enabled with server certificate verification using the
+system root CAs. No additional configuration is needed for standard TLS.
+Mutual TLS (mTLS), where both client and server present certificates, is
+optional and requires additional configuration (see examples below).
 
-- `insecure` (default = false): whether to enable client transport security for
-  the exporter's HTTPs or gRPC connection. See
+- `insecure` (default = false): whether to disable transport security entirely.
+  When set to true, no TLS is used at all. See
   [grpc.WithInsecure()](https://godoc.org/google.golang.org/grpc#WithInsecure)
   for gRPC.
 - `curve_preferences` (default = []): specify your curve preferences that will
@@ -21,23 +25,22 @@ By default, TLS is enabled:
   - P256
   - P384
 
-As a result, the following parameters are also required:
+The following certificate parameters can be configured:
 
-- `cert_file`: Path to the TLS cert to use for TLS required connections. Should
-  only be used if `insecure` is set to false.
+- `ca_file`: Path to the CA cert. For a client this verifies the server
+  certificate. For a server this verifies client certificates. If empty, the
+  system root CAs are used.
+  - `ca_pem`: Alternative to `ca_file`. Provide the CA cert contents as a string instead of a filepath.
+
+- `cert_file`: Path to the TLS certificate. For a server this is required to
+  serve TLS. For a client this is only needed for mTLS (client certificate
+  authentication).
   - `cert_pem`: Alternative to `cert_file`. Provide the certificate contents as a string instead of a filepath.
 
-- `key_file`: Path to the TLS key to use for TLS required connections. Should
-  only be used if `insecure` is set to false.
+- `key_file`: Path to the TLS private key. Must be provided alongside
+  `cert_file`.
   - `key_pem`: Alternative to `key_file`. Provide the key contents as a string instead of a filepath.
 
-A certificate authority may also need to be defined:
-
-- `ca_file`: Path to the CA cert. For a client this verifies the server
-  certificate. For a server this verifies client certificates. If empty uses
-  system root CA. Should only be used if `insecure` is set to false.
-  - `ca_pem`: Alternative to `ca_file`. Provide the CA cert contents as a string instead of a filepath.
-
 You can also combine defining a certificate authority with the system certificate authorities.
 
 - `include_system_ca_certs_pool` (default = false): whether to load the system certificate authorities pool