server: pod-to-pod communication should use same TLS cert as pod-kv comms, not node.crt

[knz]

Describe the problem

Currently pod-pod communication load and use node.crt.
It only requires the cert to have CN=node and does not perform checks further.

This is problematic in two ways:

• it does not protect against a mistaken pod-pod connection from one tenant to another (i.e. there won't be an error if pod 1 for tenant A connects to pod 1 for tenant B)
• it creates a file with CN=node on the filesystem which, if leaked, can be used to establish SQL connections with node-level privilege

Expected outcome

We should use the same TLS cert for pod-pod connections as used for pod-kv connections.
And also we should verify upon incoming pod-pod connections that the tenant ID in the cert matches the local tenant ID.

[knz]

cc @dhartunian @catj-cockroach @aaron-crl @piyush-singh for triage

[knz]

Discussed with @catj-cockroach - we should use a separate node cert, not the tenant client cert. I'll take this.