Docs: Clarify if/when TLS is required or optional

[wes-spinks]

Is your feature request related to some problem you are facing? Please describe that problem here.

Request for a slight clarification around TLS requirements.
Existing docs do not clearly explain when (or if) TLS is required vs. optional for different authentication patterns.
This can lead to confusion and consume time during implementation, particularly when integrating with third-party services.

Multiple user guides show tls.enabled: false (Hello World, API key authentication) without explaining:

1. When TLS can/should be disabled - Development and testing only, or is this production-safe for certain patterns?
2. Security implications - What risks exist when running without TLS?
3. Production guidance - When can TLS be enabled as a best practice vs. being a hard requirement (if ever)?

I assume it is usually optional, as I was able to deploy a test instance with listener.tls.enabled: false and can confirm:

• API key auth from k8s secrets works
• External HTTPS metadata fetching works
• Auth policies requiring external metadata works

Note: I did not test all features and auth patterns so I cannot speak to other configurations.

This was encountered when integrating Authorino with an OpenShift service (using API keys + external HTTPS validation). The deployment only worked after enabling TLS, but it was initially unclear whether TLS was required for a technical (Authorino) reason or if TLS was specifically being enforced specifically by the integration's configs.

Describe the solution you'd like

One or both of:

• Add note(s) to examples:
  • Note that guides use tls.enabled: false for simplicity
  • Link to production deployment guidance
  • Add callouts explaining the security tradeoff
• Add a "Production Deployment Security" section in Getting Started explaining:
  • When to enable TLS
  • When TLS can be disabled
  • What TLS provides or protects

Describe alternatives you've considered

Maintain this information in external, third-party, documents.

Additional context:

Testing performed on OpenShift cluster with Authorino Operator and following the Hello World guide using API keys, with additional external HTTPS metadata validation configured, to confirm functionality without TLS.