feat(epp): add --tls-min-version and --tls-cipher-suites flags

[andresllh]

What type of PR is this?
/kind feature

What this PR does / why we need it:

Adds two new CLI flags to the EPP (Endpoint Picker) for configuring TLS
minimum version and cipher suites on the ext_proc gRPC server:

• --tls-min-version — accepts Go crypto/tls version constant names
  (e.g., VersionTLS12, VersionTLS13)
• --tls-cipher-suites — accepts a comma-separated list of Go crypto/tls
  cipher suite names (e.g., TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256).
  Only effective for TLS 1.2 and below; TLS 1.3 cipher suites are fixed
  by the Go standard library and not configurable via this flag.

These flags allow cluster administrators to enforce a TLS security profile
on the llm-d-router's gRPC server, aligning with platform-level TLS policies
(e.g., OpenShift's cluster-wide TLS profile).

The parsed values are applied to both TLS config paths (static cert and
cert-reload) via an extracted applyTLSOverrides method, with dedicated
unit tests in tls_test.go.

Companion PR: kserve/kserve#5924 (adds template
variables to pass these flags from the KServe config system).

Which issue(s) this PR fixes:
Fixes #2239

Release note:

Added --tls-min-version and --tls-cipher-suites CLI flags to llm-d-router for configuring TLS security profile on the ext_proc gRPC server. Note: --tls-cipher-suites only applies to TLS 1.2 and below; TLS 1.3 cipher suites are fixed by Go's crypto/tls and not configurable.

[github-actions]

🚨 Unsigned commits detected! Please sign your commits.

For instructions on how to set up GPG/SSH signing and verify your commits, please see GitHub Documentation.

[zdtsw]

i think in general this will work, basically the idea is to put the responsiblity on the one who creates router deployment to choose values that are both valid and compatible.

just food for thought:

• wrong TLS version fails fast (pod crash on startup), so that case is safe.
• incompatible cipher is fuzzier, depends on whether the gateway is fail open or closed, and in the worst
  case the request bypasses the router entirely and falls back to round-robin.

[elevran]

Clean, well-tested addition - thanks!
Minor doc update before this merges.

[elevran]

Go's crypto/tls only honors CipherSuites for TLS 1.2 and below; TLS 1.3 suites are fixed and not configurable here. If an admin sets --tls-min-version=VersionTLS12 alongside a restrictive --tls-cipher-suites list, a client can still negotiate TLS 1.3 with suites outside that list, so the cipher restriction is silently not enforced on 1.3 connections.

• Worth a one-line callout in the help text given the stated goal of enforcing a platform TLS profile.
• Update to release-note in PR description to make this more explicit on release

[andresllh]

Done — updated both:

• Flag help text: --tls-cipher-suites now reads: "Only effective for TLS 1.2 and below; TLS 1.3 cipher suites are not configurable."
• Release note: Added the same caveat: "Note: --tls-cipher-suites only applies to TLS 1.2 and below; TLS 1.3 cipher suites are fixed by Go's crypto/tls and not configurable."

[zdtsw]

LGTM, thanks