fix(security): remove Disabled TLS gateway mode to prevent plaintex

[hossain-rayhan]

Summary

Removes the spec.tls.gateway.mode: Disabled option to eliminate the security risk of plaintext Mongo wire protocol traffic.

Problem

The Disabled TLS mode caused the DocumentDB gateway to serve connections in plaintext, while documentation incorrectly stated that "the gateway still encrypts all connections using an internally generated self-signed certificate." This created a silent security vulnerability where:

1. Credentials traveled on the pod network in cleartext
2. status.connectionString contained tls=true regardless of actual TLS state
3. SCRAM-SHA-256 authentication over plaintext leaks enough for offline brute force

See issue #356 for full details.

Solution

Option A from the issue — remove unencrypted traffic as a possibility:

• Remove Disabled from the GatewayTLS.Mode enum → Enum=SelfSigned;CertManager;Provided
• Default empty/unset mode to SelfSigned so existing CRs keep working with encryption
• Update certificate controller to treat empty mode as SelfSigned

Changes

File	Change
api/preview/documentdb_types.go	Remove Disabled from enum, add SelfSigned default
internal/controller/certificate_controller.go	Empty mode → SelfSigned behavior
internal/controller/certificate_controller_test.go	Add 2 unit tests
docs/.../tls.md	Remove "Disabled" tab
docs/.../connecting-to-documentdb.md	Remove Disabled row from table
docs/.../api-reference.md	Update enum documentation
CHANGELOG.md	Document breaking change
CRDs (auto-generated)	Updated via make manifests generate

Breaking Change

Users with mode: Disabled must update their manifests:

• Option 1: Remove the mode field entirely (defaults to SelfSigned)
• Option 2: Explicitly set mode: SelfSigned

The gateway will automatically use a cert-manager generated self-signed certificate.

Testing

• Unit tests pass: go test ./internal/controller/... -run "TestEmptyModeDefaultsToSelfSigned|TestDisabledModeNotSupported"
• CRD enum verified: only [SelfSigned, CertManager, Provided]
• No Disabled references remain in documentation
• Full test suite passes

Verification

# Verify CRD enum
grep -A 10 'mode:' documentdb.io_dbs.yaml

# Run unit tests
cd operator/src && go test ./internal/controller/... -v -run "Empty|Disabled"

Fixes #356